Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-75887

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.12

Default version status: affected

  • 1790102793 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.13

Default version status: affected

  • 1791299243 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • 1790606051 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • 1791836468 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • 1790636171 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.17

Default version status: affected

  • 1789939565 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.18

Default version status: affected

  • 1789904865 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1790095950 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1790112153 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1790142788 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.22

Default version status: affected

  • 1790130905 to < *unaffected

References