7.4

CVE-2026-50236

Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version 1787056403
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.15
Default Statusaffected
Version 1787028559
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version 1787054159
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.17
Default Statusaffected
Version 1787631382
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.18
Default Statusaffected
Version 1786540776
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.19
Default Statusaffected
Version 1786486822
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.20
Default Statusaffected
Version 1786534931
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.21
Default Statusaffected
Version 1786574043
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.22
Default Statusaffected
Version 1786607915
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.202
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 7.4 3.1 3.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://access.redhat.com/security/cve/CVE-2026-50236
https://bugzilla.redhat.com/show_bug.cgi?id=2484745
https://access.redhat.com/errata/RHSA-2026:54583
https://access.redhat.com/errata/RHSA-2026:54602
https://access.redhat.com/errata/RHSA-2026:54770
https://access.redhat.com/errata/RHSA-2026:54555
https://access.redhat.com/errata/RHSA-2026:54545
https://access.redhat.com/errata/RHSA-2026:56789
https://access.redhat.com/errata/RHSA-2026:56912
https://access.redhat.com/errata/RHSA-2026:56854
https://access.redhat.com/errata/RHSA-2026:60023