CVE-2026-50237
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
Risk Assessment
Risk of privilege escalation within the OpenShift cluster and violation of tenant isolation. An attacker may gain access to resources not available at their level.
Recommendation
Upgrade OpenShift Console to a patched version. Restrict the ability to create ProjectHelmChartRepository and monitor console egress traffic.
Original NVD description (English source)
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.