CVE-2026-50236
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Risk Assessment
Risk of unauthorized access to internal network resources from the console, potentially leading to data leakage or further attacks.
Recommendation
Upgrade OpenShift Console to a patched version. Additionally, validate and restrict URLs used in webhooks.
Original NVD description (English source)
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.