The image-customization-controller (ICC) in the OpenShift bare metal provisioning stack serves customized CoreOS images via an HTTP file server. The custom http.FileSystem implementation returns IsDir() == true for the root path and implements Readdir() to return every registered image. When Go's http.FileServer falls back to directory listing (no index.html), it renders an HTML index of every image filename (UUID-based). Since URL unpredictability is the sole access-control mechanism, directory listing voids this control entirely. Any pod with network access to metal3-image-customization-service.openshift-machine-api.svc.cluster.local can enumerate and download all customized images. These images contain embedded ignition configs with pull secrets and host network configuration.

Source: OCPBUGS-105396 (Project Glasswing AI security audit)
Component: Bare Metal Hardware Provisioning / OS Image Provider