{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/openshift-bare-metal-provisioning-stack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-82976"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenShift (Bare Metal Provisioning Stack)"],"_cs_severities":["high"],"_cs_tags":["credential-access","discovery","provisioning","openshift"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eA vulnerability in the image-customization-controller of OpenShift's bare metal provisioning stack allows unauthenticated network access to sensitive data. The controller hosts an HTTP file server on port 8084 that fails to implement authentication or authorization. The file system implementation permits a directory listing at the root path, which reveals image UUIDs. These images contain Ignition configuration files that include base64-encoded cluster pull secrets, potential IRONIC_RAMDISK_SSH_KEY values, proxy settings, and NetworkManager keyfiles.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to the provisioning network segment.\u003c/li\u003e\n\u003cli\u003eAttacker probes the OpenShift provisioning controller on TCP port 8084.\u003c/li\u003e\n\u003cli\u003eAttacker sends a GET request to the root path (/) to retrieve the browsable directory listing.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to enumerate all image file names (UUIDs).\u003c/li\u003e\n\u003cli\u003eAttacker downloads specific ISO or initramfs images using the enumerated UUIDs.\u003c/li\u003e\n\u003cli\u003eAttacker extracts the embedded Ignition configuration files from the downloaded images.\u003c/li\u003e\n\u003cli\u003eAttacker decodes the base64 cluster pull secrets and retrieves sensitive SSH keys and network configuration parameters.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an adjacent attacker to gain unauthorized access to sensitive cluster credentials, including the cluster pull secret and SSH keys. This facilitates further compromise of the OpenShift environment or lateral movement within the provisioning network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict network access to port 8084 on the OpenShift image-customization-controller to trusted management or provisioning subnets using network policies or firewall rules.\u003c/li\u003e\n\u003cli\u003eAudit existing Ignition configuration files for exposed secrets until a vendor patch is applied.\u003c/li\u003e\n\u003cli\u003eMonitor logs for unauthorized HTTP requests to the provisioning controller endpoint, specifically directory listing attempts or bulk image downloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:01:01Z","date_published":"2026-11-03T20:01:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openshift-cve-2026-82976/","summary":"The image-customization-controller in OpenShift bare metal provisioning exposes an unauthenticated HTTP file server on port 8084 that permits directory listing and unauthorized access to embedded Ignition configurations containing cluster secrets and SSH keys.","title":"Red Hat OpenShift: Bare metal provisioning controller information disclosure (CVE-2026-82976)","url":"https://feed.craftedsignal.io/briefs/2026-11-openshift-cve-2026-82976/"}],"language":"en","title":"CraftedSignal Threat Feed - OpenShift (Bare Metal Provisioning Stack)","version":"https://jsonfeed.org/version/1.1"}