CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:54188
https://access.redhat.com/errata/RHSA-2026:54206
https://access.redhat.com/errata/RHSA-2026:54545
https://access.redhat.com/errata/RHSA-2026:54555
https://access.redhat.com/errata/RHSA-2026:54583
https://access.redhat.com/errata/RHSA-2026:54602
https://access.redhat.com/errata/RHSA-2026:54770
https://access.redhat.com/errata/RHSA-2026:56789
https://access.redhat.com/errata/RHSA-2026:56854
https://access.redhat.com/errata/RHSA-2026:56912
https://access.redhat.com/errata/RHSA-2026:60023
https://access.redhat.com/security/cve/CVE-2026-50237
https://bugzilla.redhat.com/show_bug.cgi?id=2484746

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falsificación de petición del lado del servidor y un fallo en la cadena de suministro en el proxy del catálogo Helm de OpenShift Console. Un inquilino de espacio de nombres puede introducir un ProjectHelmChartRepository con una URL arbitraria que el pod de la consola obtiene del lado del servidor, eludiendo las restricciones de salida del inquilino. Combinado con el envenenamiento de metadatos del catálogo y la instalación de gráficos mediada por el administrador, esto permite la escalada de privilegios.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 16:10

NVD link : CVE-2026-50237

Mitre link : CVE-2026-50237

CVE.ORG link : CVE-2026-50237

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-50237", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50237", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:41:09.111141Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift:4.12::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "versions": [{"status": "unaffected", "version": "1786511587", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "versions": [{"status": "unaffected", "version": "1786477760", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "1787056403", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "1787028559", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "1787054159", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "1787631382", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "1786540776", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1786486822", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "1786534931", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1786574043", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1786607915", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-11T12:17:38.347", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54188", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54206", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54545", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54555", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54583", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54602", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:54770", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56789", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56854", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:56912", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:60023", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50237", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}, {"lang": "es", "value": "Se encontr\u00f3 una falsificaci\u00f3n de petici\u00f3n del lado del servidor y un fallo en la cadena de suministro en el proxy del cat\u00e1logo Helm de OpenShift Console. Un inquilino de espacio de nombres puede introducir un ProjectHelmChartRepository con una URL arbitraria que el pod de la consola obtiene del lado del servidor, eludiendo las restricciones de salida del inquilino. Combinado con el envenenamiento de metadatos del cat\u00e1logo y la instalaci\u00f3n de gr\u00e1ficos mediada por el administrador, esto permite la escalada de privilegios."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "secalert@redhat.com"}