Description (CNA)
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat OpenShift Container Platform 4.14 | unaffected 1787056403 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.15 | unaffected 1787028559 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.16 | unaffected 1787054159 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.17 | unaffected 1787631382 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.18 | unaffected 1786540776 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.19 | unaffected 1786486822 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.20 | unaffected 1786534931 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.21 | unaffected 1786574043 before * |
| Red Hat / Red Hat OpenShift Container Platform 4.22 | unaffected 1786607915 before * |
CWE
CWE-918
References
- https://access.redhat.com/errata/RHSA-2026:54545
- https://access.redhat.com/errata/RHSA-2026:54555
- https://access.redhat.com/errata/RHSA-2026:54583
- https://access.redhat.com/errata/RHSA-2026:54602
- https://access.redhat.com/errata/RHSA-2026:54770
- https://access.redhat.com/errata/RHSA-2026:56789
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/security/cve/CVE-2026-50236
- https://bugzilla.redhat.com/show_bug.cgi?id=2484745
ADP enrichment
No English description supplied.
No references supplied.