CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images...