---
id: "CVE-2026-82976"
kind: "vulnerability"
aliases: ["CVE-2026-82976"]
title: "OpenShift bare metal provisioning: unauthenticated image server leaks cluster pull secret"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bare-metal", "image-customization-controller", "infrastructure", "kubernetes", "openshift"]
not_affected_if: ["isolated-provisioning-network", "no-bare-metal-provisioning"]
published_at: "2026-11-03T19:18:10+00:00"
first_seen_at: "2026-11-03T19:44:53+00:00"
updated_at: "2026-11-03T19:46:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82976", "first_seen_at": "2026-11-03T19:44:53+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T19:46:48+00:00"}]
---

# OpenShift bare metal provisioning: unauthenticated image server leaks cluster pull secret

The image-customization-controller in OpenShift's bare metal provisioning stack serves an unauthenticated HTTP file server on port 8084 with a browsable directory listing that reveals per-host image UUIDs. Anyone on the provisioning network can download those images and recover the embedded Ignition config, which contains the cluster pull secret and an optional SSH key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Bare metal IPI clusters only: check the image-customization-controller pod in the openshift-machine-api namespace (oc -n openshift-machine-api get pods | grep image-customization).
- From a host on the provisioning network or a workload pod, request http://<controller-ip>:8084/ ; a directory listing of UUID-named images means it is exposed.
- Red Hat's page lists no fixed OpenShift version; check Bugzilla 2526334 / OCPBUGS-105396 and the Red Hat CVE page for errata.

## Timeline

- 2026-11-03T19:44:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82976
- 2026-11-03T19:46:48+00:00 analyst — Red Hat CVE page read: Important 7.1, no fixed OCP version published on page; workaround is network restriction of port 8084 plus rotation. Fix unknown.

## Documents

- [advisory] Red Hat CVE-2026-82976 https://access.redhat.com/security/cve/CVE-2026-82976
- [mitigation] Red Hat CVE-2026-82976 https://access.redhat.com/security/cve/CVE-2026-82976

## From the sources

A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.

### Evidence
**pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names**
```go
func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {
    f.mu.Lock()
    defer f.mu.Unlock()
    result := []fs.FileInfo{}
    for _, im := range f.images {
        result = append(result, im)
    }
    return result, nil
}

func (f *imageFileSystem) Open(name string) (http.File, error) {
    f.log.Info("Open", "path", name)
    if name == "/" {
        return f, nil
    }
    ...
```

**cmd/controller/main.go — file server bound on all interfaces without auth or TLS**
```go
http.Handle("/", http.FileServer(imageServer.FileSystem()))

go func() {
    server := &http.Server{
        Addr:              imagesBindAddr,   // default ":8084"
        ReadHeaderTimeout: 5 * time.Second,
    }
    err := server.ListenAndServe()
```

**pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image**
```go
func (b *ignitionBuilder) authFile() ignition_config_types_32.File {
    source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret)
    return ignition_config_types_32.File{
        Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"},
        ...
```

### Attack Pattern
Adjacent provisioning-network client → GET / lists UUID image names → download ISO/initramfs → extract embedded Ignition → recover cluster pull secret and SSH key.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_