CVE-2026-50237

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

State: Published
Severity: 7.4 High
Published: Aug 11, 2026
Updated: Sep 21, 2026
Reserved: Jun 4, 2026

Read the record on cve.org

Description

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L	redhat

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Red Hat OpenShift Container Platform 4.12Red Hat	1786511587 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	1786477760 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	1787056403 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	1787028559 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	1787054159 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	1787631382 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	1786540776 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	1786486822 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	1786534931 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	1786574043 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	1786607915 and laterNot affected

References

RHSA-2026:54188vendor-advisory
RHSA-2026:54206vendor-advisory
RHSA-2026:54545vendor-advisory
RHSA-2026:54555vendor-advisory
RHSA-2026:54583vendor-advisory
RHSA-2026:54602vendor-advisory
RHSA-2026:54770vendor-advisory
RHSA-2026:56789vendor-advisory
RHSA-2026:56854vendor-advisory
RHSA-2026:56912vendor-advisory
RHSA-2026:60023vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-50237vdb-entry
RHBZ#2484746issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.