Red Hat OpenShift: Bare metal provisioning controller information disclosure (CVE-2026-82976)

A vulnerability in the image-customization-controller of OpenShift's bare metal provisioning stack allows unauthenticated network access to sensitive data. The controller hosts an HTTP file server on port 8084 that fails to implement authentication or authorization. The file system implementation permits a directory listing at the root path, which reveals image UUIDs. These images contain Ignition configuration files that include base64-encoded cluster pull secrets, potential IRONIC_RAMDISK_SSH_KEY values, proxy settings, and NetworkManager keyfiles.

Attack Chain

1. Attacker gains access to the provisioning network segment.
2. Attacker probes the OpenShift provisioning controller on TCP port 8084.
3. Attacker sends a GET request to the root path (/) to retrieve the browsable directory listing.
4. Attacker parses the response to enumerate all image file names (UUIDs).
5. Attacker downloads specific ISO or initramfs images using the enumerated UUIDs.
6. Attacker extracts the embedded Ignition configuration files from the downloaded images.
7. Attacker decodes the base64 cluster pull secrets and retrieves sensitive SSH keys and network configuration parameters.

Impact

Successful exploitation allows an adjacent attacker to gain unauthorized access to sensitive cluster credentials, including the cluster pull secret and SSH keys. This facilitates further compromise of the OpenShift environment or lateral movement within the provisioning network.

Recommendation

• Restrict network access to port 8084 on the OpenShift image-customization-controller to trusted management or provisioning subnets using network policies or firewall rules.
• Audit existing Ignition configuration files for exposed secrets until a vendor patch is applied.
• Monitor logs for unauthorized HTTP requests to the provisioning controller endpoint, specifically directory listing attempts or bulk image downloads.