CVE-2026-7309 — The OpenShift Container Platform Build System Information Disclosure

title: CVE-2026-7309 - OpenShift Build System Environment Variable Injection
id: scw-2026-04-28-ai-1
status: experimental
level: medium
description: |
  Detects the instantiation of a build configuration in OpenShift via the API, specifically targeting the injection of environment variables like LD_PRELOAD or http_proxy. This is a direct indicator of the vulnerability described in CVE-2026-7309, allowing for information disclosure or potential further exploitation by manipulating build container environments.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7309/
tags:
  - attack.persistence
  - attack.t1574.002
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/apis/build.openshift.io/v1/namespaces/'
      cs-uri|contains:
          - '/buildconfigs/'
      cs-uri|contains:
          - '/instantiate'
      cs-method:
          - 'POST'
  selection_env_vars:
      cs-uri-query|contains:
          - 'LD_PRELOAD'
      condition: selection AND selection_env_vars
  selection_env_vars_proxy:
      cs-uri-query|contains:
          - 'http_proxy='
      condition: selection AND selection_env_vars_proxy
  condition: selection AND (selection_env_vars OR selection_env_vars_proxy)
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse