9.3

CVE-2026-75885

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.12
Default Statusaffected
Version 1790102793
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version 1790606051
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version 1790636171
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.17
Default Statusaffected
Version 1789939565
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.18
Default Statusaffected
Version 1789904865
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.19
Default Statusaffected
Version 1790095950
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.20
Default Statusaffected
Version 1790112153
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.21
Default Statusaffected
Version 1790142788
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.22
Default Statusaffected
Version 1790130905
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.354
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.3 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://access.redhat.com/security/cve/CVE-2026-75885
https://bugzilla.redhat.com/show_bug.cgi?id=2517885
https://access.redhat.com/errata/RHSA-2026:71450
https://access.redhat.com/errata/RHSA-2026:71453
https://access.redhat.com/errata/RHSA-2026:71454
https://access.redhat.com/errata/RHSA-2026:71447
https://access.redhat.com/errata/RHSA-2026:70587
https://access.redhat.com/errata/RHSA-2026:70647
https://access.redhat.com/errata/RHSA-2026:70617
https://access.redhat.com/errata/RHSA-2026:73853
https://access.redhat.com/errata/RHSA-2026:73869