openshift-ansible installer: unverified remote inventory scripts execute with cluster-provisioning privileges

Impact

The installer container's run script downloads remote inventory and dynamic inventory scripts over the network and executes them without any integrity check. An attacker who controls the HTTP server hosting those scripts, or who can intercept the fetch, substitutes their own executable and gets arbitrary code execution as the installer's user with full cluster-provisioning rights. On a GPU fleet that is the account that lays down the OpenShift control plane and worker nodes, so the compromise is of the cluster build itself, not one workload: node bootstrap config, machine configs and credentials handed to GPU worker pools are all in reach. Reprovisioning a cluster built by a compromised installer run is far more expensive than a patch.

Who can reach it

No authentication. An attacker who can MITM the installer's HTTP fetch or who has compromised the server that serves the inventory scripts; exploitation requires winning that network position, which is why the record scores attack complexity high. Only matters while an install or provisioning run is executing.

What to do

Apply the Red Hat update for openshift-ansible on the installer host or pull a fixed installer container image; the advisory (RHSA tracked at access.redhat.com) is the place to get the fixed version - the record given here names no fixed release. Until then, host inventory and dynamic scripts only over HTTPS from a trusted internal source, or fetch and verify them out of band and mount them into the installer container instead of letting run download them. No node drain or reboot is involved - this is tooling used at provisioning time.

References

Related entries

• Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP pathsCVE-2020-8595 · IstioHigh
• containerd: Overly broad default permissions on containerd-managed directoriesCVE-2024-25621 · containerdHigh
• runc: Insufficient verification of masked-path bind mounts (/dev/null replaced by symlink) enables containerCVE-2025-31133 · runcHigh
• runc: Attacker misdirects runc writes to /proc via racing symlinksCVE-2025-52881 · runcHigh
• Traefik: Path traversal in the WASM plugin installation mechanismCVE-2025-54386 · TraefikHigh
• KubeVirt: safepath OpenAtNoFollow resolves via /proc/self/fd, defeating the symlink protectionCVE-2026-13201 · KubeVirtHigh