An incomplete fix for CVE-2024-45496 was identified in the OpenShift Container Platform build system. The buildconfigs/instantiate API still accepts arbitrary environment variable names (including LD_PRELOAD, PATH, BUILDAH_RUNTIME, DOCKER_CONFIG, http_proxy, https_proxy) that propagate to the docker-build container, which remains privileged: true. A user with the stock edit ClusterRole can inject these env vars into any BuildConfig in the namespace. The env var name validation only applies a format regex with no semantic deny-list for dangerous names. In stock OpenShift, the edit role already grants Secret read access, making proxy interception largely redundant. The practical impact is limited to unsupported minimal role configurations. Affected: openshift/api build/v1/consts.go Tested on: OCP 4.21.0 CVE-2024-45496 fix applied but env injection into docker-build remains.