# CVE-2024-7387: Red Hat OpenShift Builder command injection via path traversal

Source: https://junglewise.ai/threats/cve-2024-7387-red-hat-openshift-builder-command-injection-via-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-17. Updated: 2026-08-11  
License: CC BY 4.0 with a link back

CVE-2024-7387 · Severity: critical · CVSS 9.1 · Published 2024-09-17

Red Hat OpenShift, a platform for managing containerized applications, contains a vulnerability in its build system. A high-privileged user can exploit this flaw to escape their container and execute commands directly on the underlying server node. This could lead to a full takeover of the physical or virtual server hosting the OpenShift services, potentially compromising all other data and applications on that node.

Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-7387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-7387 being exploited in the wild.

**How severe is CVE-2024-7387?** Critical severity, with a CVSS score of 9.1, published 17 September 2024.

**Which products and versions are affected?** github.com/openshift/builder (Go) <= 4.0.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=4.0.0.

**Is there a fix for CVE-2024-7387?** A patch was published on 2024-09-17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-7387 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2024-7387?** Check whether you run github.com/openshift/builder (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the openshift/builder component of Red Hat OpenShift. When using the 'Docker' build strategy, an attacker with high privileges can use the 'spec.source.secrets.secret.destinationDir' attribute in a 'BuildConfig' definition to override executable files within the privileged build container. By traversing the file system and replacing critical binaries, the attacker can achieve command injection. Because the build container runs with elevated privileges, this allows the attacker to escape the container and execute arbitrary commands on the underlying OpenShift host node. The issue is addressed in various Red Hat errata (RHSA-2024:6691, etc.) and a specific commit in the openshift/builder repository.

## Affected products

- Red Hat OpenShift Container Platform <= 4.0.0 (Go package), 4.12, 4.13, 4.14, 4.15, 4.16

## Identifiers

- CVE-2024-7387
- GHSA-qqv8-ph7f-h3f7
- GO-2024-3129

## Timeline

- 2024-09-17: disclosed
- 2024-09-17: advisory
- 2024-09-17: patched

## References

- [https://access.redhat.com/security/cve/CVE-2024-7387](https://access.redhat.com/security/cve/CVE-2024-7387)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2302259](https://bugzilla.redhat.com/show_bug.cgi?id=2302259)
- [https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1](https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1)
- [https://pkg.go.dev/vuln/GO-2024-3129](https://pkg.go.dev/vuln/GO-2024-3129)
- [https://access.redhat.com/errata/RHSA-2024:6691](https://access.redhat.com/errata/RHSA-2024:6691)