EUVD-2026-56133
GHSA-c4v8-c9cj-xrmr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Network-reachable SSRF requiring only authenticated developer access (PR:L); scope changes because console pod bridges to cluster-internal network; moderate C/I/A reflects partial impact via reflected responses and potential lateral reach.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
AnalysisAI
Server-Side Request Forgery in Red Hat OpenShift Container Platform 4's Dev Console webhook helpers allows authenticated users to coerce the console pod into issuing arbitrary outbound HTTP requests on their behalf. Because the console pod operates from a privileged network position within the cluster, this enables lateral movement to internal services - including the Kubernetes API server, metadata endpoints, and internal microservices - that would otherwise be unreachable from outside the cluster. No public exploit or CISA KEV listing has been identified at time of analysis, but the Scope:Changed CVSS metric reflects the cross-boundary nature of the impact.
Technical ContextAI
OpenShift Container Platform 4 (CPE: cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4) ships a web-based developer console with webhook helper endpoints designed to relay or validate HTTP callbacks. CWE-918 (Server-Side Request Forgery) describes the root cause: user-controlled input is used to construct an outbound request without allowlist validation of the target. The additional complication here is path neutralization - likely directory traversal sequences or URL encoding tricks that bypass any naive prefix-based filtering - allowing targeting of arbitrary endpoints rather than just the intended webhook receiver. Because the console pod runs with elevated cluster privileges and resides inside the cluster network, SSRF from this component is more dangerous than from an externally-facing but unprivileged application: it can reach the internal Kubernetes API, etcd-adjacent services, cloud provider instance metadata endpoints (e.g., 169.254.169.254), or other internal cluster services invisible from outside.
RemediationAI
Apply the Red Hat-issued patch for OpenShift Container Platform 4 as described at https://access.redhat.com/security/cve/CVE-2026-50236. The Red Hat Customer Portal advisory should specify the exact z-stream release containing the fix - consult that advisory directly for the precise fixed version, as it was not confirmed in the provided data. As a compensating control prior to patching, restrict developer console access to trusted users only via OpenShift RBAC, limiting who holds the roles that permit access to webhook helper endpoints. Network-level egress policies (NetworkPolicy or EgressNetworkPolicy resources) on the console namespace can be applied to allowlist only expected outbound destinations, preventing the console pod from reaching internal metadata endpoints or sensitive internal services; note this may break legitimate webhook validation functionality if the allowlist is too narrow and should be tested in a non-production environment first. Auditing OpenShift audit logs for unusual outbound requests originating from the console pod can serve as a detection mechanism while the patch is staged.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Privilege escalation in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a com
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Double-free memory corruption in libxml2's SAX parser Python bindings allows a remote attacker to crash Python applicati
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privi
Credential theft in Red Hat OpenShift Container Platform's Windows Machine Config Operator (WMCO) allows adjacent-networ
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today