CVE-2024-45497
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A flaw in the OpenShift build process mounts the host's /var/lib/kubelet/config.json file into the docker-build container with write access. This allows an attacker to overwrite the file containing sensitive credentials for pulling images from private repositories.
Risk Assessment
An attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrate sensitive secrets, impacting the availability of image-dependent services and exposing confidential information.
Recommendation
Immediately change the volume mount to read-only mode, restrict access to the config.json file, and apply the latest security patches from Red Hat for OpenShift.
Other vulnerabilities in OpenShift
See all- CVE-2016-1906Critical
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
- CVE-2026-1784High
The Route resource in OpenShift allows defining routes to expose pods via HAProxy. Insufficient validation of the spec.path field in a Route document could allow controlled injection of HAProxy configuration.
Original NVD description (English source)
A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows the attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties.