Y2
Public vulnerability disclosure

CVE-2026-75888

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

publishedCWE-918

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.

Investigate in Cyber JSONMarkdown
Technical severity7.7 highCVSS 3.1 · CNA: redhat
Published2026-10-12Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Source: CNA: redhat

Affected products and versions

ProductVersionsAuthority
Red Hat OpenShift Container Platform 4.12
Red Hat
openshift4/ose-console
https://catalog.redhat.com/software/containers/ 		≥ 1792976642; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.14
Red Hat
openshift4/ose-console
https://catalog.redhat.com/software/containers/ 		≥ 1791842061; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.15
Red Hat
openshift4/ose-console
https://catalog.redhat.com/software/containers/ 		≥ 1791836468; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.16
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1792882312; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.18
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1792874271; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.19
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1791626503; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.20
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1791962432; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.21
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1792057253; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 4.22
Red Hat
openshift4/ose-console-rhel9
https://catalog.redhat.com/software/containers/ 		≥ 1791977124; < * (unaffected, rpm)
Other versions: affected 		CNA: redhat
Red Hat OpenShift Container Platform 5
Red Hat
openshift5/ose-console-rhel9
https://access.redhat.com/downloads/content/package-browser/ 		Range not reported
Other versions: affected 		CNA: redhat

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.7
high		 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCNA: redhat

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References