Aller au contenu
en Se connecter
7.2 Élevée

CVE-2026-75886 A flaw was found in openshift/console

Description

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat OpenShift Container Platform 4 Versions non publiées
Red Hat OpenShift Container Platform 4.20 1790112153 premières → < 1790112153 1790112153
Red Hat OpenShift Container Platform 4.21 1790142788 premières → < 1790142788 1790142788
Red Hat OpenShift Container Platform 4.22 1790130905 premières → < 1790130905 1790130905
Red Hat OpenShift Container Platform 4.19 1790095950 premières → < 1790095950 1790095950
Red Hat OpenShift Container Platform 4.17 1789939565 premières → < 1789939565 1789939565
Red Hat OpenShift Container Platform 4.18 1789904865 premières → < 1789904865 1789904865

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat OpenShift Container Platform 4

Les 629 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-82976 Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret 7.1 Élevée CVE-2026-120831 Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service 6.5 Moyenne CVE-2026-120830 Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure 7.4 Élevée CVE-2026-120194 Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step 7.5 Élevée
Suivre cette CVE