CVE-2026-75888

A flaw was found in the OpenShift console allowing unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints. A remote attacker can send crafted devfile payloads, leading to Server-Side Request Forgery (SSRF) and, by sending repeated large requests without a specified content length, to unbounded memory growth and Denial of Service (DoS).

A path traversal vulnerability was found in the OpenShift console at the /locales/resource.json endpoint, exploiting the lng and ns query parameters. An unauthenticated attacker can read sensitive .json files from the pod filesystem, including plugin manifests and configuration files, and can also target registered dynamic-plugin backends.

A flaw was found in openshift/console where CatalogdHandler lacks proper authentication and forwards the openshift-session-token cookie. An unauthenticated remote attacker can send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and gaining a relay into the openshift-catalogd namespace.

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112. Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.