CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:54188
https://access.redhat.com/errata/RHSA-2026:54206
https://access.redhat.com/errata/RHSA-2026:54545
https://access.redhat.com/errata/RHSA-2026:54555
https://access.redhat.com/errata/RHSA-2026:54583
https://access.redhat.com/errata/RHSA-2026:54602
https://access.redhat.com/errata/RHSA-2026:54770
https://access.redhat.com/errata/RHSA-2026:56789
https://access.redhat.com/errata/RHSA-2026:56854
https://access.redhat.com/errata/RHSA-2026:56912
https://access.redhat.com/errata/RHSA-2026:60023
https://access.redhat.com/security/cve/CVE-2026-50237
https://bugzilla.redhat.com/show_bug.cgi?id=2484746

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-11 12:17

Updated : 2026-09-08 11:17

NVD link : CVE-2026-50237

Mitre link : CVE-2026-50237

CVE.ORG link : CVE-2026-50237

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-50237", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50237", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:41:09.111141Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4.12::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "versions": [{"status": "unaffected", "version": "1786511587", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "versions": [{"status": "unaffected", "version": "1786477760", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "1787056403", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "1787028559", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "1787054159", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "1787631382", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "1786540776", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1786486822", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.2", "versions": [{"status": "unaffected", "version": "1786534931", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1786574043", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1786607915", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-11T12:17:38.347", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54188", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54206", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54545", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54555", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54583", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54602", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54770", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56789", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56854", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56912", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60023", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50237", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}], "lastModified": "2026-09-08T11:17:42.617", "sourceIdentifier": "secalert@redhat.com"}