Skip to content
CVE PROGRAM SOURCE RECORD7.4 High

CVE-2026-50236

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • 1787056403 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • 1787028559 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • 1787054159 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.17

Default version status: affected

  • 1787631382 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.18

Default version status: affected

  • 1786540776 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1786486822 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1786534931 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1786574043 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.22

Default version status: affected

  • 1786607915 to < *unaffected

References