EUVD-2026-85702
GHSA-v74g-7mx6-787p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a credible remote-attack priority despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, unauthenticated, low-complexity exploitation with no user interaction - the easiest possible access profile - and the description independently corroborates 'unauthenticated attacker' and a simple query-parameter manipulation, so vector and prose agree. Impact is confidentiality-only (C:H/I:N/A:N), consistent with a file-disclosure path traversal that cannot modify or crash the system; the 7.5 HIGH score is driven entirely by exposure of sensitive data. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation at this time - this is a 'high-CVSS by ease-of-access' issue rather than a confirmed in-the-wild threat. One nuance to verify: disclosure is constrained to '*.json' files, which bounds the confidentiality blast radius (plugin manifests and configs rather than arbitrary secrets like /etc/shadow), so real-world severity depends on what JSON-formatted secrets a given cluster stores; the C:H rating is defensible but on the aggressive side for a .json-scoped read. The console being unauthenticated-facing makes this worth prioritizing for internet-exposed OpenShift consoles. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated path traversal in the OpenShift console's /locales/resource.json endpoint allows remote attackers to read arbitrary *.json files from the console pod filesystem by manipulating the lng and ns query parameters, exposing plugin manifests and configuration files, and potentially enabling traversal against registered dynamic-plugin backends. The flaw is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) and affects Red Hat OpenShift Container Platform 4; no public exploit code has been identified at time of analysis and there is no CISA KEV telemetry, but per the independent assessment this remains a credible remote-attack priority because the endpoint is reachable without credentials and yields high-confidentiality reads. Impact is limited to information disclosure - integrity and availability are not affected per the assessed vector.
RemediationAI
No vendor-released patch identified at time of analysis; Red Hat tracks this issue at https://access.redhat.com/security/cve/CVE-2026-75887 with engineering coordination in Bugzilla 2517889 (https://bugzilla.redhat.com/show_bug.cgi?id=2517889), and remediation should begin by monitoring that advisory for the exact console errata and fixing release - do not deploy unverified version numbers. Until a patch is published, apply the following specific compensating controls and accept their trade-offs: (1) Place a reverse proxy or WAF in front of the console route that rejects requests to /locales/resource.json whose lng or ns parameters contain encoded or decoded dot-segment sequences (../, %2e%2e%2f, ..%5c, and double-encoded variants); this blocks the known primitive but must be tuned carefully because locale identifiers are legitimate input and sloppy pattern matching can break localization while encoding-variant bypasses remain possible. (2) Restrict the console route's network reachability to trusted management networks, VPN, or bastion hosts so the unauthenticated endpoint cannot be reached from the general internet - highly effective against remote exploitation but operationally disruptive for end users who need console access from other networks. (3) Where dynamic plugins are not required, disable or unregister them to eliminate the secondary traversal path into plugin backends; note this removes plugin functionality entirely. (4) Enforce authentication at the proxy/ingress layer ahead of the console service so that even the unauthenticated PR:N endpoint cannot be touched anonymously - effective but may conflict with console login flow endpoints that must remain public. (5) Reduce the sensitive content visible in the console pod filesystem (rotate or externalize secrets and config that would be readable if traversal succeeds) and enable audit logging on the console route to detect repeated traversal attempts as an early-warning indicator; these reduce blast radius rather than prevent exploitation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-22 improper limitation of a pathname to a restricted directory (path traversal) in the OpenShift web console. The console serves localized UI bundles through the /locales/resource.json endpoint, which resolves a resource file using the client-supplied lng (language) and ns (namespace) query parameters. Because those parameters are concatenated into a filesystem path without adequate normalization or containment checks, an attacker can inject traversal sequences (for example ../) to escape the intended locales directory. The endpoint serves only *.json content, which constrains but does not eliminate the attack surface: JSON is used throughout the console pod for dynamic-plugin manifests, configuration and metadata files, so traversal yields meaningful reconnaissance or secret-adjacent data. The description additionally notes the traversal can be leveraged against registered dynamic-plugin backends, meaning the console's proxying of plugin requests may extend the path-traversal primitive beyond the console container itself to plugin service endpoints. The CVSS vector confirms an unauthenticated (PR:N), network-reachable (AV:N), low-complexity (AC:L), no-user-interaction (UI:N) attack with high confidentiality impact and no integrity or availability impact, matching the assessed conditions.
Know when Red Hat Openshift Container Platform 4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive *.json files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
Executive ViewAI
Red Hat OpenShift Container Platform 4 is affected by an unauthenticated path traversal vulnerability in the console's /locales/resource.json endpoint, allowing remote attackers to read arbitrary JSON files from the console pod filesystem. This could expose plugin manifests and configuration data, potentially revealing sensitive environment details to unauthenticated users. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but organizations with internet-facing or broadly accessible OpenShift consoles should prioritize mitigation because the flaw requires no credentials and yields high-confidentiality reads.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the OpenShift console, placing it behind an authenticated proxy, deploying WAF rules to block path traversal attempts on /locales/resource.json, disabling dynamic plugins if not required, and enabling enhanced logging and monitoring for anomalous access to JSON files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape th
Privilege escalation in Red Hat OpenShift Container Platform 4's insights-runtime-extractor DaemonSet lets an authentica
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend
Exploit-DB