EUVD-2026-39596
GHSA-2cqr-m38f-xf8g
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Cluster admin write access required (PR:H); victim must open report in browser (UI:R); XSS crosses infrastructure-to-browser boundary (S:C); session/credential theft feasible (C:H); no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored cross-site scripting (XSS) payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.
AnalysisAI
Stored XSS in Red Hat's Pen Drive report generator allows a cluster administrator to inject persistent JavaScript payloads into cluster objects such as ClusterVersion spec.channel, which then execute in the browser of any user who opens a generated HTML report. The flaw (CWE-79) stems from cluster-sourced data being rendered into HTML output without escaping or sanitization, crossing a security boundary (S:C) from infrastructure into end-user browser sessions. No public exploit or CISA KEV listing has been identified at time of analysis, but the C:H confidentiality impact indicates potential for session token or credential harvesting from report consumers.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored/persistent variant. The Pen Drive report generator reads cluster-state data from resources such as the OpenShift ClusterVersion object's spec.channel field and serializes that data into HTML output without applying HTML-entity encoding or a sanitization filter. Because cluster administrators have write access to these cluster objects, a payload embedded in a string field persists at the cluster level and is reproduced verbatim in every subsequent report render. The CVSS S:C metric confirms a security boundary crossing: the malicious payload originates in cluster infrastructure but executes in the security context of an end-user's browser session, where it can access cookies, tokens, and local browser storage belonging to the report viewer.
RemediationAI
No vendor-released patch version has been confirmed in the available data; monitor https://access.redhat.com/security/cve/CVE-2026-13083 for an updated advisory containing a fixed version. The definitive fix requires the Pen Drive report generator to apply HTML-entity encoding or a vetted sanitization library to all cluster-sourced string fields before rendering them into HTML output, and optionally enforce a strict Content-Security-Policy header on report delivery to prevent injected scripts from executing even if a payload is present. As an immediate compensating control, restrict distribution of generated HTML reports to a minimal set of trusted personnel, reducing the victim pool. Cluster administrators should audit mutable string fields in cluster objects - particularly ClusterVersion spec.channel and similar spec fields - for suspicious content. If the HTML report generation feature can be disabled without operational impact, disabling it eliminates the attack surface entirely until a patch is available. Note that restricting report distribution does not remove the stored payload from cluster objects; sanitization or object field remediation is required to fully clear injected content.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today