Server-side request forgery in Red Hat OpenShift Container Platform 4.12
Priority LOW 33CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00473 41st percentileScored 2026-11-07
Fix Fixed Red Hat: 11 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1786511587 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1786477760 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1787056403 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1787028559 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 1787054159 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | 1787631382 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1786540776 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1786486822 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1786534931 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1786574043 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | 1786607915 | Patch available | CNA |
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1786511587 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1786477760 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1787056403 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1787028559 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 1787054159 Patch available CNA
- Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 1787631382 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1786540776 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1786486822 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1786534931 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1786574043 Patch available CNA
- Red Hat OpenShift Container Platform 4.22 VendorRed Hat Affected — Fixed in 1786607915 Patch available CNA
CPE names CNA · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.12::el9 | 4.12 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:openshift:4.17::el9 | 4.17 | — | Red Hat |
| cpe:/a:redhat:openshift:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.21::el9 | 4.21 | — | Red Hat |
- cpe:/a:redhat:openshift:4.12::el9 Versions 4.12 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:openshift:4.17::el9 Versions 4.17 — ·Red Hat
- cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.21::el9 Versions 4.21 — ·Red Hat
Remediation
Red Hat 11 advisories
- RHSA-2026:60023 Released 2026-09-03 · Red Hat rating ImportantOpenShift Container Platform 4.17.57 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9 +20
- RHSA-2026:56912 Released 2026-08-26 · Red Hat rating CriticalOpenShift Container Platform 4.15.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
- RHSA-2026:56854 Released 2026-08-26 · Red Hat rating ImportantOpenShift Container Platform 4.16.69 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
Show 8 more Red Hat advisories
- RHSA-2026:56789 Released 2026-08-26 · Red Hat rating CriticalOpenShift Container Platform 4.14.72 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
- RHSA-2026:54188 Released 2026-08-20 · Red Hat rating ImportantOpenShift Container Platform 4.13.70 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
- RHSA-2026:54206 Released 2026-08-20 · Red Hat rating ImportantOpenShift Container Platform 4.12.96 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
- RHSA-2026:54545 Released 2026-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.18.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-console-rhel9
- RHSA-2026:54555 Released 2026-08-19 · Red Hat rating ImportantOpenShift Container Platform 4.19.43 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:54770 Released 2026-08-18 · Red Hat rating ImportantOpenShift Container Platform 4.22.10 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-image-registry-rhel9-operator +11
- RHSA-2026:54583 Released 2026-08-18 · Red Hat rating ImportantOpenShift Container Platform 4.20.34 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +2
- RHSA-2026:54602 Released 2026-08-18 · Red Hat rating ImportantOpenShift Container Platform 4.21.29 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +6
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 and 7 more products — RHSA-2026:54545
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-36989 Server-side request forgery in Red Hat OpenShift Container Platform 4.14Priority LOW 33
- Advisory ·
Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 and 7 more products — RHSA-2026:54555
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-36989 Server-side request forgery in Red Hat OpenShift Container Platform 4.14Priority LOW 33
Show 1 more group
- Advisory ·
Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 and 7 more products — RHSA-2026:56854
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-36989 Server-side request forgery in Red Hat OpenShift Container Platform 4.14Priority LOW 33
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:54206 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:54188 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:56789 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:56912 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:56854 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:60023 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:54545 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:54555 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:54583 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:54602 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:54770 |
Not affected: 11 products
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50237
- 2026-10-03 Alias added: GHSA-5mvj-m7fw-m49w
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-50237 · CVE Program
- CVE-2026-50237 · NVD
- FIRST EPSS
- GHSA-5mvj-m7fw-m49w · GitHub Advisory Database · CC BY 4.0
- CVE-2026-50237 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences