CVE-2024-9042 is an OS command injection vulnerability (CWE-78) affecting Kubernetes Windows nodes in Red Hat OpenShift for Windows Containers versions >=10.16.0 and <10.16.2. The flaw allows an attacker with the ability to query the node's '/logs' endpoint to execute arbitrary commands on the host. This can result in unauthorized code execution, data modification, or denial of service. The vulnerability is tracked under Red Hat advisory RHSA-2025:9136. No patch or effective mitigation currently meets Red Hat's standards for ease of use, deployment, or stability. Detection is possible via audit logs monitoring for suspicious node 'logs' queries.

An attacker with access to query the '/logs' endpoint on Windows worker nodes can execute arbitrary OS commands with the privileges of the node process. This can lead to unauthorized code execution, data read or modification, and potential disruption of the node. The vulnerability compromises confidentiality and integrity but does not impact availability directly. Since commands execute as the node, malicious actions may appear to originate from legitimate processes.

Currently, no official patch or mitigation meeting Red Hat's criteria for this vulnerability is available. Users should monitor cluster audit logs for suspicious queries to the node '/logs' endpoint to detect potential exploitation attempts. Red Hat recommends upgrading to a fixed version once available. For Windows Machine Config Operator upgrades, refer to the official Red Hat documentation. Customers with a Red Hat Technical Account Manager (TAM) can seek direct guidance. Until a fix is released, restricting access to the node logs endpoint and limiting permissions may reduce risk.