IT SBIT Services
Schneeberger
DEEN
CVE tracker

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

CVE-2026-62284High 8.6

← All vulnerabilities

Summary

The console proxy of the OSAC operator, a Kubernetes operator, parses kubeconfig data from Kubernetes Secrets without sanitizing the resulting configuration. An attacker who can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig in a namespace the proxy can read can run arbitrary processes as the console-proxy service account inside the pod. The attacker can also make the proxy send requests to arbitrary servers (server-side request forgery). Remote and auto VM cluster modes are affected, auto being the default; local mode is not affected.

Affected

  • OSAC operator (osac-project/osac-operator) before commit 7e4222b, per the CNA record
  • Affected revision named by the CNA: 8220502
  • Remote and auto VM cluster modes (auto is the default)
  • Local-only mode is not affected

Fixed in

  • Commit 7e4222b fixes the credential-plugin execution path
  • Commit 7e4222b does not address the server-address SSRF path
  • Fixed release version: Unknown.
  • Status of commit 86466378 regarding the SSRF path: Unknown.

Workaround

  • No official workaround known.
  • Use local VM cluster mode if remote or auto mode is not required.
  • Restrict who can create or modify Secrets with the label osac.openshift.io/remote-cluster-kubeconfig.
  • Review Secret read access granted by the console proxy RoleBinding.

Exploitation

  • No evidence of exploitation in the wild found in the sources checked.
  • No public proof of concept found.
  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
  • EPSS: 0.51 % (percentile 43).

Our recommendation

  • Check whether OSAC operator is deployed and which VM cluster mode is used.
  • Switch to local mode where possible.
  • Restrict Secret create and modify rights, and review the console proxy RoleBinding.
  • Monitor the GitHub security advisory GHSA-5w5g-j6hw-6p8f and osac-operator releases for a fixed version that covers both the exec and SSRF paths.
  • Treat remote or auto mode deployments as unpatched for SSRF until a fixed release is confirmed.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:44.

Original description (NVD)

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config`. An attacker who can create or modify a Secret labeled `osac.openshift.io/remote-cluster-kubeconfig`: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply `users[].user.exec`. When `rest.TransportFor` builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-`console-proxy` service account inside the pod. Attacker-controlled `clusters[].server` also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively `local` mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed