Security readout for executives and security teams
Plain-English summary
This flaw affects Red Hat OpenShift Enterprise 3.2 build handling. An authenticated user could abuse Source-to-Image build access to reach the Docker socket from a build pod and gain higher privileges. That makes it important for organizations running this older platform version, especially multi-tenant clusters.
Executive priority
Prioritize if any legacy OpenShift Enterprise 3.2 cluster remains in use, especially shared or multi-tenant environments. Authenticated users reaching the Docker socket can undermine container isolation and create broader platform risk.
Technical view
CVE-2016-3738 describes improper access restriction for STI builds in Red Hat OpenShift Enterprise 3.2. The reported impact is authenticated remote access to the Docker socket through build-pod related vectors, enabling privilege gain. The source bundle provides no CVSS score, CWE, CPE list, or detailed fixed package information.
Likely exposure
Exposure appears limited to Red Hat OpenShift Enterprise 3.2 environments that allow authenticated users to run STI or S2I builds. The provided metadata does not identify other affected products or versions.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. The described attacker is remote but authenticated, and the privilege path depends on access to build-pod behavior and Docker socket exposure.
Researcher notes
Evidence is sparse: the bundle provides the CVE description and a Red Hat advisory reference, but no CVSS, CWE, CPEs, exploit details, or explicit fixed versions. Do not assume exploit availability or affected versions beyond OpenShift Enterprise 3.2.
Mitigation direction
- Review Red Hat advisory RHSA-2016:1094 for applicable vendor updates.
- Apply the Red Hat-provided fix where the advisory applies.
- Restrict STI/S2I build permissions to trusted users until remediated.
- Review build-pod security settings for unintended Docker socket exposure.
- Monitor build activity for unusual authenticated privilege changes.
Validation and detection
- Inventory clusters for Red Hat OpenShift Enterprise 3.2.
- Confirm whether STI/S2I builds are enabled and who can run them.
- Verify RHSA-2016:1094 remediation status against vendor guidance.
- Review audit logs for suspicious build-pod activity.
- Check whether build pods can access Docker socket resources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Container behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2016-3738 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2016:1094CVE reference · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.