Riskcovery

CVE-2026-50236

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

State
Published
Severity
7.4 High
Published
Aug 11, 2026
Updated
Sep 21, 2026
Reserved
Jun 4, 2026

Read the record on cve.org

Description

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
Red Hat OpenShift Container Platform 4.14Red Hat
  • 1787056403 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 1787028559 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 1787054159 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat
  • 1787631382 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 1786540776 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 1786486822 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat
  • 1786534931 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat
  • 1786574043 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat
  • 1786607915 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.