IT SBIT Services
Schneeberger
DEEN
CVE tracker

Red Hat OpenShift Console: Server-Side Request Forgery via Helm chart URL

CVE-2026-75888High 7.7

← All vulnerabilities

Summary

An authenticated user of the OpenShift web console can supply a crafted Helm chart URL that is not properly validated. The console pod then fetches arbitrary URLs, which can expose sensitive information through error messages or allow blind port scanning of internal cluster services. Any valid console login is sufficient, so the risk depends on how many accounts exist, including developer and shared accounts. The CVSS score is 7.7 (High); the CVE record is still awaiting NVD analysis.

Affected

  • Red Hat OpenShift Container Platform 4 (CNA data lists versions 4.12, 4.14, 4.15, 4.16, 4.18, 4.19, 4.20, 4.21 and 4.22 as affected by default)
  • Exact affected build numbers: Unknown.

Fixed in

  • Fixed versions: Unknown. Verify the fixed build for your minor version in the linked Red Hat errata (e.g. RHSA-2026:82785 for 4.14, RHSA-2026:82813 for 4.15) before upgrading; the errata may not explicitly confirm the console fix.
  • Upstream fix: validation of chart URLs in the console (openshift/console pull request 666 in a fork; check the official repository for the merged commit).

Workaround

  • No vendor-confirmed workaround. Red Hat states that mitigation is either not available or does not meet its criteria.
  • Restrict egress from the console pod to what is needed.
  • Limit which users hold console login.

Exploitation

  • CISA SSVC: exploitation none, not automatable, partial technical impact.
  • Not listed in the CISA KEV catalog; no known exploitation.
  • No public proof-of-concept found; this is not conclusive.

Our recommendation

  • Check whether your OpenShift console is reachable from users or networks you do not trust.
  • Review console user accounts and remove unneeded ones.
  • Apply the fixed OpenShift release for your minor version once the fixed build is confirmed in the errata.
  • Restrict egress from the console pod and monitor console logs for unusual Helm chart URL requests.
  • After patching, test internal Helm chart repositories, as stricter validation may block chart URLs that resolve to private IP addresses.
  • Also check for the separate unauthenticated Devfile SSRF (CVE-2026-75885).

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 08:51.

Original description (NVD)

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.

NVD references (11)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed