CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:54545
https://access.redhat.com/errata/RHSA-2026:54555
https://access.redhat.com/errata/RHSA-2026:54583
https://access.redhat.com/errata/RHSA-2026:54602
https://access.redhat.com/errata/RHSA-2026:54770
https://access.redhat.com/errata/RHSA-2026:56789
https://access.redhat.com/errata/RHSA-2026:56854
https://access.redhat.com/errata/RHSA-2026:56912
https://access.redhat.com/errata/RHSA-2026:60023
https://access.redhat.com/security/cve/CVE-2026-50236
https://bugzilla.redhat.com/show_bug.cgi?id=2484745

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad SSRF autenticada en los asistentes de webhook de la Consola de Desarrollo de OpenShift Console. Las URLs de destino proporcionadas por el usuario se obtienen del lado del servidor sin validación, con neutralización de ruta, lo que permite la orientación a puntos finales arbitrarios y la reflexión completa de la respuesta desde la posición de red privilegiada del pod de la consola.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-50236

Mitre link : CVE-2026-50236

CVE.ORG link : CVE-2026-50236

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-50236", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50236", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T15:03:58.823186Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "1787056403", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "1787028559", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "1787054159", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "1787631382", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "1786540776", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1786486822", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "1786534931", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1786574043", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1786607915", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-11T12:17:38.183", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54545", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54555", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54583", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54602", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54770", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56789", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56854", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56912", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60023", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50236", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484745", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad SSRF autenticada en los asistentes de webhook de la Consola de Desarrollo de OpenShift Console. Las URLs de destino proporcionadas por el usuario se obtienen del lado del servidor sin validaci\u00f3n, con neutralizaci\u00f3n de ruta, lo que permite la orientaci\u00f3n a puntos finales arbitrarios y la reflexi\u00f3n completa de la respuesta desde la posici\u00f3n de red privilegiada del pod de la consola."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "secalert@redhat.com"}