EUVD-2026-83454
GHSA-hm52-6738-r26p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed OpenShift console endpoint
-
DeliverySend crafted devfile payload to /api/devfile/
-
ExploitConsole pod issues SSRF to internal services
-
ExecutionReflect partial internal responses to attacker
-
PersistFlood large requests with no content-length
-
ImpactExhaust pod memory causing DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the OpenShift console's unauthenticated /api/devfile/ and /api/devfile/samples/ endpoints; per PR:N no authentication is needed. The SSRF path requires the attacker to submit crafted devfile payloads that the console parses and dereferences, and its value depends on internal services being reachable from the console pod's network position (typical in a cluster). The DoS path requires sending repeated large requests WITHOUT a specified Content-Length header to trigger unbounded memory growth. The primary limiting factor is exposure: clusters where the web console is not reachable by untrusted networks materially reduce risk, since these endpoints are reachable pre-authentication only to whoever can hit the console. |
| Impact | This is a genuinely serious issue by CVSS signals: the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L (9.3) describes an unauthenticated, network-reachable, low-complexity SSRF that crosses a trust boundary (S:C) from the OpenShift console pod into internal cluster services, plus a memory-exhaustion DoS (A:L). The dual attack surface (SSRF via crafted devfile payloads and unbounded memory growth via missing content-length handling) on unauthenticated /api/devfile/ endpoints makes it attractive to attackers who can reach the console. However, exploitation-likelihood signals are absent: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - this is a high-CVSS issue whose real-world urgency currently rests on severity and reachability rather than observed exploitation. One caveat: the description characterizes confidentiality as 'reflects PARTIAL responses,' which is somewhat weaker than a full C:H read primitive; the C:H rating is defensible for internal-service enumeration/metadata exposure but the 'partial' wording suggests confidentiality may be closer to C:L in practice - worth verifying against the Red Hat advisory. Prioritize patching where the console is network-exposed, as no authentication barrier limits the attacker. |
| Exploit ScenarioDerived | A remote unauthenticated attacker reachable to the OpenShift web console sends a crafted devfile payload to /api/devfile/ or /api/devfile/samples/, coercing the console pod into making SSRF requests to internal cluster services (e.g., metadata endpoints or internal APIs) and reading back partial reflected responses. Separately, the attacker floods the same endpoints with large requests lacking a content-length header to drive unbounded memory growth and crash the console pod (DoS). No public exploit code was identified at time of analysis, but no authentication is required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Unauthenticated HTTP requests to the OpenShift console's /api/devfile/ and /api/devfile/samples/ endpoints let remote attackers trigger server-side request forgery from the console pod into internal cluster services and exhaust console memory through repeated large requests lacking a Content-Length header. Red Hat rates this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L); our assessment agrees on the unauthenticated, network-reachable SSRF crossing a trust boundary but lowers confidentiality to C:L because only partial internal responses are reflected, producing a lower composite score. Clusters that expose the web console to untrusted networks are most at risk; no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
RemediationAI
Patch status is not specified in the available intelligence and no vendor-released patch was identified in the provided data at time of analysis; track https://access.redhat.com/security/cve/CVE-2026-75885 and Bugzilla 2517885 for a fixed console image or OpenShift Container Platform update, and upgrade as soon as a patched console build is released. Until then, the highest-value control is exposure reduction: place the console behind an authenticated reverse proxy, VPN, or bastion so the unauthenticated /api/devfile/ and /api/devfile/samples/ handlers are not reachable from untrusted networks, accepting that this also restricts legitimate user access. Where devfile sample browsing is not required, block those two paths at the ingress or edge router, with the trade-off that Devfile-based developer workflows break. Enforce a maximum request body size and require a valid Content-Length header at the ingress controller to blunt the memory-growth DoS, noting that oversized legitimate devfile payloads may be rejected and limits must be tuned. Apply Kubernetes NetworkPolicy to restrict egress from console pods to only the services they legitimately need, which reduces SSRF reachability but can break console integrations until the allow list is baselined. Finally, rate-limit requests to the Devfile endpoints and alert on anomalous large or malformed bodies to detect exploitation attempts.
Affected ProductsAI
OpenShift Container Platform web console (the openshift-console component serving the Devfile endpoints /api/devfile/ and /api/devfile/samples/); the shared console codebase means OKD console deployments are likely implicated as well. No CPE strings or explicit version ranges were included in the provided intelligence, so affected versions cannot be enumerated from this data; assume any console build containing these Devfile handlers is in scope until Red Hat publishes a fixed release. Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-75885 and the associated Bugzilla record at https://bugzilla.redhat.com/show_bug.cgi?id=2517885 for the authoritative product and version matrix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the OpenShift Container Platform web console backend, which exposes unauthenticated Devfile-related API handlers at /api/devfile/ and /api/devfile/samples/. Devfiles are YAML-based specifications that define development environments and can reference sample projects, registries, and external URLs; the console parses attacker-supplied devfile content and dereferences URLs found within it without adequately validating whether targets are internal-only addresses. This is a classic CWE-918 server-side request forgery: the console pod, positioned inside the cluster network with access to internal services such as the Kubernetes API server, metrics endpoints, and other cluster-internal HTTP services, issues requests chosen by the attacker and returns partial responses back to the requester. The vendor CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L records the scope change (S:C) as the attacker crosses from the console to internal services; our independent assessment keeps the unauthenticated PR:N and network AV:N characteristics and the SSRF trust-boundary crossing, but assesses confidentiality as C:L since only partial internal responses are reflected, limiting data exfiltration, and preserves the availability impact as A:L for the memory-exhaustion path. The DoS condition arises because the console handler reads request bodies without a declared Content-Length, so repeated large uploads accumulate unbounded in memory until the pod experiences memory pressure, OOM termination, or console unavailability.
Know when Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SSRF crossing pod boundary (S:C); confidentiality set to C:L because only partial internal responses are reflected, with A:L for the memory-exhaustion DoS.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
Executive ViewAI
Red Hat OpenShift clusters that expose the web console to untrusted networks are exposed to an unauthenticated, network-reachable server-side request forgery (CVE-2026-75885, CVSS 9.3) that lets an outside attacker pivot from the console pod into internal cluster services and degrade console availability. Because the flaw requires no credentials, any internet- or partner-facing console becomes an entry point that bypasses the network boundary security teams rely on, potentially exposing internal service responses and disrupting operator access to the cluster. Leadership should treat console exposure as the primary risk driver and act on network containment while awaiting a vendor fix.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict network exposure of the OpenShift web console to trusted networks only; place the console behind an authenticating proxy, VPN, or bastion; enforce rate limiting, request-size limits, and Content-Length requirements at the edge for /api/devfile/ and /api/devfile/samples/; apply network policies/egress controls to limit what internal services the console pod can reach; and monitor those endpoints for anomalous request volume or unexpected internal responses.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Exploit-DB