CVE Alert: CVE-2026-82976 – Red Hat

A flaw was found in the image-customization-controller used in OpenShift’s bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** “`go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info("Open", "path", name) if name == "/" { return f, nil } … “` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** “`go http.Handle("/", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default ":8084" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() “` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** “`go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"}, … “` ### Attack Pattern Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.

**Risk verdict:** Treat this as a high-priority exposure for any affected bare-metal provisioning environment reachable by untrusted or unnecessary network clients.

**Why this matters:** An attacker who can reach the provisioning service may obtain cluster authentication material and host-specific secrets, creating a path from information disclosure to unauthorised registry access or host compromise. The practical blast radius depends on the permissions and validity of exposed credentials; KEV, SSVC, PoC and EPSS data were not supplied, so exploitation activity and urgency beyond the technical risk remain uncertain.

**Most likely attack path:** An adjacent-network attacker needs no account or user interaction and faces low attack complexity: browse the image directory, retrieve an image, then extract its embedded configuration. Scope is unchanged, but stolen credentials or SSH keys could support access to other systems if their permissions and network reach allow it.

**Who is most exposed:** OpenShift deployments using bare-metal provisioning are most exposed, particularly where the provisioning network is shared with workloads, contractors or other less-trusted hosts.

Review service and network telemetry for unexpected requests to port 8084, especially root-path requests followed by image downloads.

Check controller logs for repeated image-file opens or access from non-provisioning sources.

Audit pull-secret and SSH-key use for unexpected clients or authentication locations.

Mitigation and prioritisation:

Apply the vendor’s fixed update as soon as available; confirm remediation status before restoring broad network access.

Immediately restrict port 8084 to required provisioning/BMC hosts using NetworkPolicy or firewall rules.

Rotate potentially exposed pull secrets and SSH keys if unauthorised access is plausible; assess dependent systems for misuse.

Validate controls and schedule changes carefully to avoid disrupting bare-metal provisioning.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.