A flaw in the OpenShift Container Platform build system allows a user with the edit ClusterRole to inject arbitrary environment variables, such as LD_PRELOAD or http_proxy, into docker-build containers through the buildconfigs/instantiate API. This capability enables the attacker to influence the build environment and potentially expose sensitive build traffic, directly compromising the confidentiality of data processed during builds. The vulnerability is a result of incomplete remediation for a prior issue and is classified under CWE‑426.

The affected system is Red Hat OpenShift Container Platform 4. Specific product versions are not listed in the CNA data; therefore all current 4.x releases are potentially impacted unless a later patch version is released.

With a CVSS score of 4.3, the vulnerability is deemed moderate in severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with edit role privileges within the cluster, implying that the threat is limited to insiders or compromised accounts rather than external attackers. The impact is primarily a loss of confidentiality for build traffic rather than denial of service or code execution.