CVE-2026-75886
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A flaw was found in openshift/console where CatalogdHandler lacks proper authentication and forwards the openshift-session-token cookie. An unauthenticated remote attacker can send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and gaining a relay into the openshift-catalogd namespace.
Risk Assessment
Disclosure of the internal operator-catalog index and relay access into the openshift-catalogd namespace may help an attacker further explore and escalate within the cluster.
Recommendation
Update openshift/console to a patched version and consider restricting network access to the console and catalogd service.
Other vulnerabilities in openshift/console
See all- CVE-2026-75885Critical
A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).
- CVE-2026-75887High
A path traversal vulnerability was found in the OpenShift console at the /locales/resource.json endpoint, exploiting the lng and ns query parameters. An unauthenticated attacker can read sensitive .json files from the pod filesystem, including plugin manifests and configuration files, and can also target registered dynamic-plugin backends.
- CVE-2026-50237High
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
- CVE-2026-50236High
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
- CVE-2024-7631Medium
A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112. Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.
Original NVD description (English source)
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS