← CVE Intelligence

CVE-2026-75885

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint PUBLISHED

Description (CNA)

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1790102793 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1791299243 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1790606051 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1791836468 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 1790636171 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 1789939565 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 1789904865 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 1790095950 before *
Red Hat / Red Hat OpenShift Container Platform 4.20unaffected 1790112153 before *
Red Hat / Red Hat OpenShift Container Platform 4.21unaffected 1790142788 before *
Red Hat / Red Hat OpenShift Container Platform 4.22unaffected 1790130905 before *

CWE

CWE-918

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.