← CVE Intelligence

CVE-2026-75887

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler PUBLISHED

Description (CNA)

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1790102793 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1791299243 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1790606051 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1791836468 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 1790636171 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 1789939565 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 1789904865 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 1790095950 before *
Red Hat / Red Hat OpenShift Container Platform 4.20unaffected 1790112153 before *
Red Hat / Red Hat OpenShift Container Platform 4.21unaffected 1790142788 before *
Red Hat / Red Hat OpenShift Container Platform 4.22unaffected 1790130905 before *

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.