{"id":"CVE-2026-75885","state":"PUBLISHED","title":"Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint","description":"A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).","publishedAt":"2026-09-18T21:58:11.958Z","updatedAt":"2026-10-23T05:10:34.351Z","severity":{"score":9.3,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift Container Platform 4.12","Red Hat Red Hat OpenShift Container Platform 4.13","Red Hat Red Hat OpenShift Container Platform 4.14","Red Hat Red Hat OpenShift Container Platform 4.15","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Red Hat OpenShift Container Platform 4.17","Red Hat Red Hat OpenShift Container Platform 4.18","Red Hat Red Hat OpenShift Container Platform 4.19","Red Hat Red Hat OpenShift Container Platform 4.20","Red Hat Red Hat OpenShift Container Platform 4.21","Red Hat Red Hat OpenShift Container Platform 4.22"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1790102793","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1791299243","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1790606051","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1791836468","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790636171","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1789939565","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1789904865","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790095950","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790112153","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790142788","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790130905","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:70587","https://access.redhat.com/errata/RHSA-2026:70617","https://access.redhat.com/errata/RHSA-2026:70647","https://access.redhat.com/errata/RHSA-2026:71447","https://access.redhat.com/errata/RHSA-2026:71450","https://access.redhat.com/errata/RHSA-2026:71453","https://access.redhat.com/errata/RHSA-2026:71454","https://access.redhat.com/errata/RHSA-2026:73853","https://access.redhat.com/errata/RHSA-2026:73869","https://access.redhat.com/errata/RHSA-2026:77321","https://access.redhat.com/errata/RHSA-2026:82813","https://access.redhat.com/security/cve/CVE-2026-75885","https://bugzilla.redhat.com/show_bug.cgi?id=2517885"],"weaknesses":["CWE-918"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/75xxx/CVE-2026-75885.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-75885","state":"PUBLISHED","datePublished":"2026-09-18T21:58:11.958Z","dateUpdated":"2026-10-23T05:10:34.351Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-08-18T13:44:59.078Z"},"containers":{"cna":{"title":"Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint","descriptions":[{"lang":"en","value":"A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS)."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1790102793","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1791299243","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1790606051","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-console","defaultStatus":"affected","versions":[{"version":"1791836468","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790636171","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1789939565","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1789904865","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790095950","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790112153","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790142788","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-console-rhel9","defaultStatus":"affected","versions":[{"version":"1790130905","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:70587","name":"RHSA-2026:70587","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70617","name":"RHSA-2026:70617","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70647","name":"RHSA-2026:70647","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71447","name":"RHSA-2026:71447","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71450","name":"RHSA-2026:71450","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71453","name":"RHSA-2026:71453","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71454","name":"RHSA-2026:71454","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73853","name":"RHSA-2026:73853","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:73869","name":"RHSA-2026:73869","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77321","name":"RHSA-2026:77321","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82813","name":"RHSA-2026:82813","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75885","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517885","name":"RHBZ#2517885","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-23T05:10:34.351Z"},"datePublic":"2026-09-18T13:48:11.069Z","x_redhatCweChain":"CWE-918: Server-Side Request Forgery (SSRF)","workarounds":[{"lang":"en","value":"https://access.redhat.com/solutions/7148487"}],"timeline":[{"lang":"en","time":"2025-11-07T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-18T13:48:11.069Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-21T19:48:46.557338Z","id":"CVE-2026-75885","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-21T20:47:11.925Z"}}]}}}