Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-75885

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.12

Default version status: affected

  • 1790102793 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.13

Default version status: affected

  • 1791299243 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • 1790606051 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • 1791836468 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • 1790636171 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.17

Default version status: affected

  • 1789939565 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.18

Default version status: affected

  • 1789904865 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1790095950 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1790112153 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1790142788 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.22

Default version status: affected

  • 1790130905 to < *unaffected

References