CVE-2024-7631
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112. Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Risk Assessment
An authenticated user can read arbitrary JSON files from the console pod, potentially leading to disclosure of sensitive information such as configurations or credentials.
Recommendation
Update OpenShift Console to a patched version. Restrict access to the endpoint for unauthorized users.
Other vulnerabilities in OpenShift Console
See all- CVE-2026-75885Critical
A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).
- CVE-2026-75888High
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
- CVE-2026-75887High
A path traversal vulnerability was found in the OpenShift console at the /locales/resource.json endpoint, exploiting the lng and ns query parameters. An unauthenticated attacker can read sensitive .json files from the pod filesystem, including plugin manifests and configuration files, and can also target registered dynamic-plugin backends.
- CVE-2026-75886High
A flaw was found in openshift/console where CatalogdHandler lacks proper authentication and forwards the openshift-session-token cookie. An unauthenticated remote attacker can send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and gaining a relay into the openshift-catalogd namespace.
- CVE-2026-50237High
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
- CVE-2026-50236High
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Original NVD description (English source)
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS