What is the CVSS score of CVE-2026-75886?

CVE-2026-75886 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-75886?

Within 24 hours, inventory all Red Hat OpenShift Container Platform 4 clusters, identify every route, load balancer, or ingress path that publishes the OpenShift Console to untrusted networks, and restrict access so that only corporate identity-aware proxies, VPN ranges, or bastion hosts can reach the console; enable audit logging on console and catalogd endpoints and alert on anomalous requests to catalogd paths. Within 7 days, confirm the restriction is enforced in every cluster (including disconnected and edge sites), review openshift-catalogd namespace RBAC and network policies to deny east-west traffic that is not explicitly required, rotate any session tokens or credentials that may have been exposed through the console, and monitor the Red Hat advisory for CVE-2026-75886 so the fix can be scheduled the moment it is released. Within 30 days, apply the vendor-released patch for Red Hat OpenShift Container Platform 4 as soon as it becomes available (tracking the exact errata version from the Red Hat advisory), re-validate console exposure after patching, and fold console reachability requirements into standard architecture review so that management interfaces are not internet-facing by default.

OpenShift Console CVE-2026-75886

EUVD-2026-85665 HIGH

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)

2026-09-23 redhat

GHSA-f8rq-4f8p-cmww

Information Disclosure Kubernetes Red Hat Red Hat Openshift Container Platform 4 Openshift Red Hat

7.2

CVSS 3.1 · Vendor: redhat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach exposed OpenShift Console endpoint
Delivery

Send request to unauthenticated CatalogdHandler
Exploit

Handler forwards session-token cookie to catalogd
Execution

Relay reaches in-cluster catalogd service
Impact

Disclose operator-catalog index and pivot into namespace

Vulnerability Assessment

Weakness	CWE CWE-441 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V4 - API and Web Service Proxy/intermediary controls
Exploitation Conditions	Exploitation requires network reachability to the OpenShift Console's CatalogdHandler endpoint, which lacks authentication and forwards the openshift-session-token cookie to the in-cluster catalogd service. No credentials, privileges, or user interaction are needed (PR:N/UI:N). Realistic exploitation is limited by whether the console endpoint is exposed to the attacker (internet-facing ingress vs. internal/VPN-only), and the impact ceiling is disclosure of the operator-catalog index and a request relay into the openshift-catalogd namespace rather than direct secret theft or code execution (C:L/I:L/A:N).
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes the most attacker-friendly access profile: network-reachable, low complexity, no privileges, no user interaction, with a scope change reflecting that the OpenShift Console (the confused deputy) is abused to reach a distinct security authority - the in-cluster catalogd service in the openshift-catalogd namespace. This is internally consistent with the description of an unauthenticated CatalogdHandler that forwards the openshift-session-token cookie, and the CWE-441 (unintended proxy/confused deputy) classification is apt. However, actual impact is bounded: C:L/I:L/A:N and the description limit the outcome to disclosure of the internal operator-catalog index plus a request relay, not full read/write of cluster secrets or code execution - so this is a genuine but moderate exposure, not a crown-jewels compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these sources; there is no public exploit identified at time of analysis. Notably, real-world reachability depends on whether the OpenShift Console/web endpoint is exposed beyond the cluster perimeter - many OpenShift consoles sit behind ingress/VPN restrictions, which tempers the AV:N reading in practice. Priority should be treated as real-but-moderate: patch on normal cadence, prioritized higher where the console is internet-facing.
Exploit ScenarioDerived	An unauthenticated attacker who can reach the OpenShift Console endpoint sends crafted requests to the CatalogdHandler, which fails to authenticate the caller and forwards the openshift-session-token cookie to the in-cluster catalogd service. The attacker thereby retrieves the internal operator-catalog index and obtains a relay foothold into the openshift-catalogd namespace. No public exploit code was identified in the provided data, and no user interaction or credentials are required per the CVSS vector.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.

RemediationAI

Patch status is not specified in the provided intelligence; refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-75886 for an official fix. In the absence of a confirmed patch, implement compensating controls: restrict network access to the OpenShift Console's CatalogdHandler endpoint to trusted networks only (e.g., internal/VPN-only), since exploitation requires network reachability to the exposed console. If the console is internet-facing, place an authenticating reverse proxy in front of it or disable external access to the CatalogdHandler route. Monitor logs for anomalous requests to the catalogd service. Trade-offs: network restrictions may impede legitimate administrative access from remote locations; an authenticating proxy adds management overhead and may not be compatible with all console features. Do not expose the console endpoint to untrusted networks without additional authentication.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is an instance of CWE-441 (Unintended Proxy or Intermediary, 'Confused Deputy'). The OpenShift Console acts as a deputy with access to the in-cluster catalogd service, but the CatalogdHandler endpoint lacks proper authentication checks. An unauthenticated attacker can send requests to this endpoint, and the console forwards the openshift-session-token cookie to the catalogd service, effectively relaying the attacker's requests. This allows the attacker to read the internal operator-catalog index and interact with the openshift-catalogd namespace. The CPE data identifies Red Hat OpenShift Container Platform 4 as the affected product, with the vulnerability residing in the openshift/console component. The scope change (S:C) in the CVSS vector reflects that the console's authority is misused to reach a separate security authority (catalogd). Impact is limited to information disclosure and a request relay (C:L/I:L/A:N), not direct code execution or secret theft.

Know when Openshift gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI 7.2 HIGH

Unauthenticated network access to an endpoint that lacks auth (PR:N/UI:N/AC:L); confused-deputy relay crosses into another service (S:C) with limited index disclosure and relay impact (C:L/I:L, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat 7.2 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

Executive ViewAI

Why It Matters

A high-severity flaw in Red Hat OpenShift Container Platform 4's Console component allows attackers who can reach the console endpoint to relay requests into the internal catalogd service, exposing the operator-catalog index and opening a path into the openshift-catalogd namespace. Because no vendor patch is currently available, every internet- or broadly reachable OpenShift console in the estate represents an unmitigated exposure that could reveal platform internals and serve as a foothold for further lateral movement. Security and platform leadership should treat this as a priority containment exercise, driven by network exposure reduction rather than patching, until Red Hat ships a fix.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the OpenShift Console so only trusted management networks, VPN, or identity-aware proxies can connect; place the console behind an authenticating reverse proxy or bastion; apply network policies that limit which workloads can reach the catalogd service and the openshift-catalogd namespace; enable and monitor audit logging for console and catalogd requests; review and minimize RBAC in the openshift-catalogd namespace; and rotate session tokens or credentials suspected of exposure.

Threat Intelligence Overview

EPSS Score

0.3%

Top 85% exploitable

Prevalence

High

Red Hat OpenShift is a widely deployed enterprise Kubernetes distribution

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.