{"metadata": {"vulnerability": "CVE-2026-82976", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-07T10:39:22Z", "date_only": false, "value": "2026-08-07T10:39:22.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.timeline.0.time", "text": "Reported to Red Hat."}, {"timestamp": "2026-08-31T14:59:35.045Z", "date_only": false, "value": "2026-08-31T14:59:35.045Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-82976", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-03T12:03:30.152Z", "date_only": false, "value": "2026-11-03T12:03:30.152Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T12:03:30.152Z", "date_only": false, "value": "2026-11-03T12:03:30.152Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.timeline.1.time", "text": "Made public."}, {"timestamp": "2026-11-03T18:36:24.334Z", "date_only": false, "value": "2026-11-03T18:36:24.334Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-82976", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-03T18:42:20.712Z", "date_only": false, "value": "2026-11-03T18:42:20.712819Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117553977111677007", "record": "CVE-2026-82976", "field": "creation_timestamp", "uuid": "f3592830-510a-4c62-aab1-fd625d27ad61", "content": "CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key.\n### Evidence**pkg/imagehandler/imagefilesystem.go \u2014 root directory is browsable and enumerates all UUID image names**```gofunc (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) {    f.mu.Lock()    defer f.mu.Unlock()    result := []fs.FileInfo{}    for _, im := range f.images {        result = append(result, im)    }    return result, nil}\nfunc (f *imageFileSystem) Open(name string) (http.File, error) {    f.log.Info(\"Open\", \"path\", name)    if name == \"/\" {        return f, nil    }    ...```\n**cmd/controller/main.go \u2014 file server bound on all interfaces without auth or TLS**```gohttp.Handle(\"/\", http.FileServer(imageServer.FileSystem()))\ngo func() {    server := &http.Server{        Addr:              imagesBindAddr,   // default \":8084\"        ReadHeaderTimeout: 5 * time.Second,    }    err := server.ListenAndServe()```\n**pkg/ignition/service_config.go:94-100 \u2014 pull secret is embedded in every served image**```gofunc (b *ignitionBuilder) authFile() ignition_config_types_32.File {    source := \"data:;base64,\" + strings.TrimSpace(b.ironicAgentPullSecret)    return ignition_config_types_32.File{        Node: ignition_config_types_32.Node{Path: \"/etc/authfile.json\"},        ...```\n### Attack PatternAdjacent provisioning-network client \u2192 GET / lists UUID image names \u2192 download ISO/initramfs \u2192 extract embedded Ignition \u2192 recover cluster pull secret and SSH key.\nhttps://www.cve.org/CVERecord?id=CVE-2026-82976https://access.redhat.com/security/cve/CVE-2026-82976https://bugzilla.redhat.com/show_bug.cgi?id=2526334https://github.com/openshift/image-customization-controllerhttps://redhat.atlassian.net/browse/OCPBUGS-105396#RedHat #RedHatOpenShiftContainerPlatform4 #RedHatOpenShiftContainerPlatform5#CVE_2026_82976#bot", "url": "https://infosec.exchange/users/cve/statuses/117553977111677007"}, {"timestamp": "2026-11-03T19:18:10Z", "date_only": false, "value": "2026-11-03T19:18:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-37J3-6WGH-2Q48", "record": "GHSA-37J3-6WGH-2Q48", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-03T19:18:10.850Z", "date_only": false, "value": "2026-11-03T19:18:10.850", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82976", "record": "FKIE_CVE-2026-82976", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T19:18:10.993Z", "date_only": false, "value": "2026-11-03T19:18:10.993", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-82976", "record": "FKIE_CVE-2026-82976", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:32:12Z", "date_only": false, "value": "2026-11-03T21:32:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-37J3-6WGH-2Q48", "record": "GHSA-37J3-6WGH-2Q48", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-03T21:32:12Z", "date_only": false, "value": "2026-11-03T21:32:12Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-37J3-6WGH-2Q48", "record": "GHSA-37J3-6WGH-2Q48", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-05T02:19:12.537Z", "date_only": false, "value": "2026-11-05T02:19:12.537Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-82976", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-05T02:19:12.537Z", "date_only": false, "value": "2026-11-05T02:19:12.537Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-06T13:51:48.186Z", "anchors": {"origin": {"timestamp": "2026-11-03T12:03:30.152Z", "date_only": false, "value": "2026-11-03T12:03:30.152Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-03T12:03:30.152Z", "date_only": false, "value": "2026-11-03T12:03:30.152Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 265698.034953, "hours": 73.80500970916667, "days": 3.075208737881945, "min_seconds": 265698.034953, "max_seconds": 265698.034953, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-03T12:03:30.152Z", "date_only": false, "value": "2026-11-03T12:03:30.152Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-82976", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-06T13:51:48.186Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}