CVE-2024-7387Critical· 9.1▾ Midnight

A flaw was found in openshift/builder

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score51/ 100 · Moderate

impact 50.1 · likelihood 0.5 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 17, 2024

Updated

Aug 11, 2026

CVSS

9.1

Vendor

—

Product

—

CWE

CWE-250

Depth score

51 · Moderate

EPSS

2.3% · p83

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Aug 11.

2.3% → 2.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 749 days

Sep 17, 2024Published
Disclosed via NVD
Aug 11, 2026Record revised
Last analysed / modified upstream
Aug 11, 2026EPSS first tracked
2.3%
Oct 6, 2026EPSS peak
2.3% → 2.3%

CWE-250 #nvd

Full technical detail▾

Overview

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the spec.source.secrets.secret.destinationDir attribute of the BuildConfig definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed