9.3
Critical
CVE-2026-75885 A flaw was found in the OpenShift console
Description
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.20 1790112153 | earliest → < 1790112153 | 1790112153 |
| Red Hat OpenShift Container Platform 4.21 1790142788 | earliest → < 1790142788 | 1790142788 |
| Red Hat OpenShift Container Platform 4.22 1790130905 | earliest → < 1790130905 | 1790130905 |
| Red Hat OpenShift Container Platform 4.19 1790095950 | earliest → < 1790095950 | 1790095950 |
| Red Hat OpenShift Container Platform 4.12 1790102793 | earliest → < 1790102793 | 1790102793 |
| Red Hat OpenShift Container Platform 4.17 1789939565 | earliest → < 1789939565 | 1789939565 |
| Red Hat OpenShift Container Platform 4.18 1789904865 | earliest → < 1789904865 | 1789904865 |
| Red Hat OpenShift Container Platform 4.14 1790606051 | earliest → < 1790606051 | 1790606051 |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.16 1790636171 | earliest → < 1790636171 | 1790636171 |
| Red Hat OpenShift Container Platform 4.13 1791299243 | earliest → < 1791299243 | 1791299243 |
| Red Hat OpenShift Container Platform 4.15 1791836468 | earliest → < 1791836468 | 1791836468 |
References
- RHSA-2026:70587 access.redhat.com
- RHSA-2026:70617 access.redhat.com
- RHSA-2026:70647 access.redhat.com
- RHSA-2026:71447 access.redhat.com
- RHSA-2026:71450 access.redhat.com
- RHSA-2026:71453 access.redhat.com
- RHSA-2026:71454 access.redhat.com
- RHSA-2026:73853 access.redhat.com
- RHSA-2026:73869 access.redhat.com
- RHSA-2026:77321 access.redhat.com
- RHSA-2026:82813 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2517885 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Container Platform 4
The 629 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
High
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Medium
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
7.4
High
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
High