CVE-2026-50237

A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.

A path traversal vulnerability was found in the OpenShift console at the /locales/resource.json endpoint, exploiting the lng and ns query parameters. An unauthenticated attacker can read sensitive .json files from the pod filesystem, including plugin manifests and configuration files, and can also target registered dynamic-plugin backends.

A flaw was found in openshift/console where CatalogdHandler lacks proper authentication and forwards the openshift-session-token cookie. An unauthenticated remote attacker can send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and gaining a relay into the openshift-catalogd namespace.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112. Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.