Description
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
Published: 2026-10-12
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery that can disclose sensitive information via the OpenShift console
Action: Assess Impact
AI Analysis

Impact

An authenticated user of the OpenShift console can supply a specially crafted Helm chart URL that is not properly validated, allowing the console pod to fetch arbitrary URLs. This Server‑Side Request Forgery can result in the exposure of error messages containing sensitive data or be used to perform blind port scanning inside the cluster, potentially revealing internal hosts and services.

Affected Systems

Red Hat OpenShift Container Platform 4 is affected. No specific minor versions are listed; all releases of the platform are potentially vulnerable until a patch is deployed.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity vulnerability, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be through the authenticated console interface; an attacker with console access can trigger the payload by submitting a malicious Helm chart URL. Successful exploitation would allow the attacker to read confidential error output or probe the internal cluster network.

Generated by OpenCVE AI on October 12, 2026 at 18:23 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply any available vendor patches or updates for OpenShift when they become available.
  • Restrict console user privileges to the minimum required to reduce the chance of SSRF exploitation.
  • Implement network policies or firewall rules that limit outbound traffic from the OpenShift console pod to only trusted destinations.
  • Monitor console pod logs and traffic for anomalous Helm chart URL requests or unexpected external connections.
  • Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Generated by OpenCVE AI on October 12, 2026 at 18:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:5

Thu, 29 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el9
cpe:/a:redhat:openshift:4.16::el9
cpe:/a:redhat:openshift:4.18::el9
References

Fri, 23 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:4.14::el9
cpe:/a:redhat:openshift:4.15::el9
References

Wed, 21 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.19::el9
References

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.20::el9
cpe:/a:redhat:openshift:4.21::el9
cpe:/a:redhat:openshift:4.22::el9
References

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Container Platform
Vendors & Products Redhat openshift Container Platform

Tue, 13 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 12 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
Title Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
First Time appeared Redhat
Redhat openshift
Weaknesses CWE-918
CPEs cpe:/a:redhat:openshift:4
Vendors & Products Redhat
Redhat openshift
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Redhat Openshift Openshift Container Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-30T04:25:16.110Z

Reserved: 2026-08-18T13:44:59.078Z

Link: CVE-2026-75888

cve-icon Vulnrichment

Updated: 2026-10-14T16:11:54.979Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-12T17:17:35.723

Modified: 2026-10-30T05:16:59.470

Link: CVE-2026-75888

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-12T15:36:20Z

Links: CVE-2026-75888 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)