Read the docs
TI-2020-16888 Aliases CVE-2020-27816

Open redirect in openshift-logging/console

Priority LOW 28CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.

Why it matters now

EPSS 0.00651 51st percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—openshift-logging/consoleVersions before elasticsearch-operator-container 4.7—No fix listedCNA
  • openshift-logging/console Vendor— Affected Versions before elasticsearch-operator-container 4.7 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*up to 4.7VulnerableElastic
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* Versions up to 4.7 Vulnerable ·Elastic
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2021:0310 Released 2021-02-08 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.16 extras security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-elasticsearch-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:0310
Not affected: 1 product
  • Red Hat OpenShift Container Platform 4.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27816
  2. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences