CVE-2014-0164
Description
openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective client.cfg configuration file, which allows local users to obtain credentials and other sensitive information by reading the file.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
World-readable mcollective client.cfg in openshift-origin-broker-util exposes credentials to local users, allowing full control over OpenShift nodes.
Vulnerability
The openshift-origin-broker-util package, used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, sets world-readable permissions on the mcollective client.cfg configuration file. This file contains sensitive information including mcollective authentication credentials. [1][2]
Exploitation
A local user on a host with the OpenShift Broker installed can read the world-readable client.cfg file. No special privileges are required beyond local access to the filesystem. The attacker can then extract the mcollective credentials. [1][2]
Impact
With the obtained mcollective credentials, an attacker gains full control over all OpenShift nodes managed via mcollective. This allows arbitrary actions on the nodes, potentially compromising the entire OpenShift environment. [1][2]
Mitigation
Red Hat released updated openshift-origin-broker-util packages that correct the file permissions. For OpenShift Enterprise 2.0.5, the fix is in RHSA-2014:0460; for version 1.2.7, in RHSA-2014:0461. Users should upgrade to the fixed packages. [1][2]
AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3- Range: 1.2.7, 2.0.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- rhn.redhat.com/errata/RHSA-2014-0460.htmlnvdVendor Advisory
- rhn.redhat.com/errata/RHSA-2014-0461.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.