Security readout for executives and security teams
Plain-English summary
This issue can expose a pod’s internal IP address through an OpenShift HAProxy cookie. It is an information disclosure problem, not evidence of direct system compromise. Business urgency is limited unless the environment still runs the affected 2016-era OpenShift Enterprise 3.2 or OpenShift Origin components.
Executive priority
Treat as a low-priority legacy exposure unless affected OpenShift deployments still exist. The main risk is infrastructure information leakage that could assist follow-on reconnaissance, not a confirmed active compromise path.
Technical view
HAProxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin disclosed the internal pod IP via the OPENSHIFT_[namespace]_SERVERID cookie. The source bundle does not provide CVSS, CWE, affected CPEs, or detailed fixed versions beyond the Red Hat advisory and Origin pull request references.
Likely exposure
Likely exposure is limited to legacy OpenShift Enterprise 3.2 or OpenShift Origin deployments using the affected HAProxy router behavior. Current exposure cannot be inferred from the provided data without asset inventory and vendor advisory review.
Exploitation context
The CVE description says local users could obtain an internal pod IP address by reading a cookie. The bundle does not cite public exploitation, and KEV status is false. No weaponized exploitation evidence is provided.
Researcher notes
Evidence is sparse: no CVSS vector, CWE, CPE, or detailed fix version is present in the bundle. Analysis should stay anchored to the cookie-based pod IP disclosure and the Red Hat and OpenShift Origin references.
Mitigation direction
- Review and apply Red Hat advisory RHSA-2016:1064 where applicable.
- Verify OpenShift Origin includes the referenced upstream correction.
- Retire or upgrade unsupported OpenShift Enterprise 3.2 environments.
- Check vendor guidance before applying compensating controls.
Validation and detection
- Inventory OpenShift Enterprise 3.2 and OpenShift Origin clusters.
- Confirm HAProxy router package or source includes the referenced fix.
- Review application cookies for unintended internal pod IP disclosure.
- Document whether affected components remain internet-facing or internal only.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2016-3711 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2016:1064CVE reference · vendor-advisory, x_refsource_REDHAT
- https://github.com/openshift/origin/pull/8334CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.