CVE-2026-7309

MediumCVSS 4.3/10Last modified Oct 26, 2026

Description

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4	—

References

https://access.redhat.com/security/cve/CVE-2026-7309Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2463451Issue Tracking, Vendor Advisory

Timeline

Published: Apr 28, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-730909.3PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an Activi CVE-2026-730958.7Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables CVE-2026-7309810.0Improper control of dynamically-loaded code vulnerability in Apache Juneau. When Apache Juneau parses a value into a property of type java.CVE-2026-7309910.0Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the req CVE-2026-73104.4A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious user with local acce CVE-2026-7310010.0Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request header CVE-2026-7310110.0Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception c CVE-2026-731025.7RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application ac CVE-2026-731087.5RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the CVE-2026-73118.1The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path CVE-2026-7311610.0Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping cre CVE-2026-7311710.0Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau RES