Server-Side Request Forgery and Supply Chain Flaw in OpenShift Console by Red Hat
CVE-2026-50237

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4
Vendor
CVE Published:
11 August 2026

What is CVE-2026-50237?

A significant exploit exists in the OpenShift Console's Helm catalog proxy, where a namespace tenant can introduce a ProjectHelmChartRepository linked to an arbitrary URL. This action allows unauthorized data access by the console pod, circumventing any egress restrictions designated for the tenant. The issue can be compounded through catalog metadata poisoning, potentially leading to escalated privileges during admin-mediated chart installations.

References

https://access.redhat.com/security/cve/CVE-2026-50237
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2484746
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.
.