OpenShift Bare Metal Provisioning Stack Vulnerability in Image Customization Controller
CVE-2026-82976

7.1HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Openshift Container Platform 4; Red Hat Openshift Container Platform 5
Vendor: CVE Published:; 3 November 2026

What is CVE-2026-82976?

A vulnerability exists in the image-customization-controller within OpenShift's bare metal provisioning architecture. This weakness arises from the lack of authentication for an HTTP file server operating on port 8084. As a result, the root path of the custom image file system is exposed, revealing a browsable directory listing of all registered images, which can be accessed by any entity on the provisioning network. An attacker can enumerate image UUIDs from this listing, download any image, and subsequently extract sensitive Ignition configuration data. This data may include critical items such as the cluster pull secret and SSH keys, significantly compromising the security of the OpenShift environment.