Path Traversal Vulnerability in OpenShift Console
CVE-2026-75887

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4.12
Red Hat Openshift Container Platform 4.13
Red Hat Openshift Container Platform 4.14
Red Hat Openshift Container Platform 4.15
Vendor
CVE Published:
23 September 2026

What is CVE-2026-75887?

A path traversal vulnerability exists in the OpenShift console, allowing unauthenticated attackers to manipulate the lng and ns query parameters of the /locales/resource.json endpoint. This manipulation can lead to unauthorized access to sensitive *.json files stored in the pod filesystem, including critical plugin manifests and configuration files. Additionally, the flaw presents the possibility of exploiting path traversal against registered dynamic-plugin backends, compromising further data integrity and security within the OpenShift environment.

Affected Version(s)

Red Hat OpenShift Container Platform 4.12 1790102793

Red Hat OpenShift Container Platform 4.13 1791299243

Red Hat OpenShift Container Platform 4.14 1790606051

References

https://access.redhat.com/errata/RHSA-2026:70587
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:70617
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:70647
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.