CVE 2026 82976

CWE data temporarily unavailable CWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.

pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names

cmd/controller/main.go — file server bound on all interfaces without auth or TLS

pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image

Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.

The image-customization-controller is deployed in the openshift-machine-api namespace as part of OpenShift's bare metal IPI provisioning flow. The image server binds on all interfaces at port 8084 with no authentication or TLS. The directory listing is unconditional — any client on the provisioning network can browse and download all served images. The embedded Ignition configs contain the cluster pull secret (registry credentials), optional SSH keys for the IPA ramdisk, proxy settings, and per-host NetworkManager keyfiles. Red Hat rates this as Important because exploitation requires adjacent network access (provisioning network) with no authentication, and the scope of exposed secrets is high — the pull secret grants access to container registries outside the cluster boundary.

There is no way to disable the directory listing or add authentication without a code change. As a workaround, administrators can apply network-level controls to restrict access to port 8084 on the image-customization-controller pod to only the BMC/provisioning network hosts that require it. Use NetworkPolicy or firewall rules to block access from workload pods. Additionally, rotate any pull secrets and SSH keys that may have been exposed if unauthorized access to the provisioning network is suspected.

Bugzilla 2526334 : image-customization-controller: Unauthenticated plaintext image server with directory listing exposes Ignition images containing cluster pull secret

CWE-548 : Exposure of Information Through Directory Listing

Common Vulnerability Scoring System (CVSS) Score Details

Info alert: Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications ).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red Hat: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

cve.org: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Red Hat CVSS v3 Score Explanation

Reconciled from source finding FIND-001 (migration 2026-09-01)

Frequently Asked Questions

"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.

The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.

Upgrade to a supported product version that includes a fix for this vulnerability (recommended).

Apply a mitigation (if one exists).

Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Apply a mitigation (if one exists).

Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.

Customers with the technical account manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

Not sure what something means? Check out our Security Glossary .

For clarification or corrections, please Red Hat Product Security .