{"id":"CVE-2026-50237","state":"PUBLISHED","title":"Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console","description":"A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.","publishedAt":"2026-08-11T11:23:55.079Z","updatedAt":"2026-09-21T15:52:56.923Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift Container Platform 4.12","Red Hat Red Hat OpenShift Container Platform 4.13","Red Hat Red Hat OpenShift Container Platform 4.14","Red Hat Red Hat OpenShift Container Platform 4.15","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Red Hat OpenShift Container Platform 4.17","Red Hat Red Hat OpenShift Container Platform 4.18","Red Hat Red Hat OpenShift Container Platform 4.19","Red Hat Red Hat OpenShift Container Platform 4.20","Red Hat Red Hat OpenShift Container Platform 4.21","Red Hat Red Hat OpenShift Container Platform 4.22"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1786511587","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1786477760","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1787056403","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1787028559","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1787054159","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1787631382","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786540776","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786486822","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786534931","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786574043","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786607915","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:54545","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54770","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/security/cve/CVE-2026-50237","https://bugzilla.redhat.com/show_bug.cgi?id=2484746"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/50xxx/CVE-2026-50237.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50237","state":"PUBLISHED","datePublished":"2026-08-11T11:23:55.079Z","dateUpdated":"2026-09-21T15:52:56.923Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-06-04T12:11:18.430Z"},"containers":{"cna":{"title":"Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console","descriptions":[{"lang":"en","value":"A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1786511587","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1786477760","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1787056403","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1787028559","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1787054159","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1787631382","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786540776","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786486822","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786534931","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786574043","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1786607915","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:54188","name":"RHSA-2026:54188","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54206","name":"RHSA-2026:54206","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54545","name":"RHSA-2026:54545","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54555","name":"RHSA-2026:54555","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54583","name":"RHSA-2026:54583","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54602","name":"RHSA-2026:54602","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54770","name":"RHSA-2026:54770","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56789","name":"RHSA-2026:56789","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56854","name":"RHSA-2026:56854","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56912","name":"RHSA-2026:56912","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60023","name":"RHSA-2026:60023","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50237","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484746","name":"RHBZ#2484746","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-21T15:52:56.923Z"},"datePublic":"2026-08-11T09:47:00.000Z","x_redhatCweChain":"CWE-918: Server-Side Request Forgery (SSRF)","workarounds":[{"lang":"en","value":"Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{\"\\n\"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories."}],"timeline":[{"lang":"en","time":"2026-04-29T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-08-11T09:47:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-11T17:41:09.111141Z","id":"CVE-2026-50237","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-11T17:50:56.110Z"}}]}}}