Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster…
Priority LOW 38CWE-441Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | 1789939565 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1789904865 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1790095950 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1790112153 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1790142788 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | 1790130905 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 1789939565 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1789904865 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1790095950 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1790112153 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1790142788 Patch available CNA
- Red Hat OpenShift Container Platform 4.22 VendorRed Hat Affected — Fixed in 1790130905 Patch available CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.17::el9 | 4.17 | — | Red Hat |
| cpe:/a:redhat:openshift:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.21::el9 | 4.21 | — | Red Hat |
| cpe:/a:redhat:openshift:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
- cpe:/a:redhat:openshift:4.17::el9 Versions 4.17 — ·Red Hat
- cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.21::el9 Versions 4.21 — ·Red Hat
- cpe:/a:redhat:openshift:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2026:70617 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.18.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-service-rhel9-operator +47
- RHSA-2026:70587 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.17.58 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2026:71447 Released 2026-09-30 · Red Hat rating ImportantOpenShift Container Platform 4.19.49 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator, registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel9-operator +8
Show 3 more Red Hat advisories
- RHSA-2026:71454 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.22.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-node-termination-handler-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator +8
- RHSA-2026:71450 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.20.40 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
- RHSA-2026:71453 Released 2026-09-29 · Red Hat rating ImportantOpenShift Container Platform 4.21.35 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 and 4 more products — RHSA-2026:70617
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53121 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointPriority MEDIUM 47
- TI-2026-53123 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handlerPriority LOW 39
- Advisory ·
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 and 4 more products — RHSA-2026:71447
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53121 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointPriority MEDIUM 47
- TI-2026-53123 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handlerPriority LOW 39
Show 3 more groups
- Advisory ·
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 and 4 more products — RHSA-2026:71450
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53121 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointPriority MEDIUM 47
- TI-2026-53123 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handlerPriority LOW 39
- Advisory ·
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 and 4 more products — RHSA-2026:71453
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53121 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointPriority MEDIUM 47
- TI-2026-53123 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handlerPriority LOW 39
- Advisory ·
Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18 and 4 more products — RHSA-2026:71454
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53121 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpointPriority MEDIUM 47
- TI-2026-53123 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handlerPriority LOW 39
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:70587 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:70617 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:71447 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:71450 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:71453 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:71454 |
Not affected: 7 products
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-75886
- 2026-10-03 Alias added: GHSA-f8rq-4f8p-cmww
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-75886 · CVE Program
- CVE-2026-75886 · NVD
- FIRST EPSS
- GHSA-f8rq-4f8p-cmww · GitHub Advisory Database · CC BY 4.0
- CVE-2026-75886 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences