Product
The image-customization-controller in OpenShift bare metal provisioning exposes an unauthenticated HTTP file server on port 8084 that permits directory listing and unauthorized access to embedded Ignition configurations containing cluster secrets and SSH keys.