The CatalogdHandler in the OpenShift console lacks authentication checks and forwards the openshift‑session‑token cookie, allowing an unauthenticated remote attacker to route traffic to the internal catalogd service. This flaw, identified as CWE‑441, can result in the disclosure of the internal operator‑catalog index and establish a relay into the openshift‑catalogd namespace, effectively exposing sensitive configuration data without requiring credentials. The primary impact is remote information disclosure, potentially compromising the confidentiality of catalog resources within the cluster.

The vulnerability is known to affect Red Hat OpenShift Container Platform 4. Since the CVE payload does not list specific releases, all versions of this product are potentially impacted.

The CVSS score of 7.2 indicates a high severity with a confidentiality impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote, unauthenticated user exploiting the console’s CatalogdHandler to forward requests to the in‑cluster catalogd service. Successful exploitation would allow an attacker to read the internal catalogd data and relay traffic into the openshift‑catalogd namespace, albeit no public patch is currently released.