Red Hat OpenShift CVE-2026-75888

Exploitation requires an authenticated OpenShift web-console session with the ability to add or load a Helm chart via a user-supplied chart repository/URL (PR:L); the crafted URL is passed to the console pod's fetch logic without proper validation (CWE-918). Limiting factors: the attacker must already possess valid console credentials and the privilege to supply a Helm chart URL, so this is not reachable by fully unauthenticated outsiders; impact is bounded to confidentiality (information disclosure via error messages and blind internal port scanning) with no integrity or availability effect. Realistic value to an attacker is highest in clusters where low-privileged console users exist and sensitive internal endpoints (metadata services, internal APIs) are reachable from the console pod.

This is a credible mid-tier priority rather than an emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) is internally consistent with the description: a network-reachable SSRF triggered by an authenticated, low-privileged console user supplying a crafted Helm chart URL, with a scope change (S:C) because the console pod is coerced into reaching other systems inside the cluster, and high confidentiality impact (C:H) via error-message disclosure and blind internal port scanning. Integrity and availability are correctly rated N. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - this is a high-CVSS issue whose real-world urgency is tempered by the PR:L authentication requirement, which limits exploitation to users who already hold valid console credentials. No signals conflict; the main gap is the complete absence of exploitation-probability data (EPSS/KEV/POC), so prioritization should lean on the authenticated prerequisite and the sensitivity of the internal network the console pod can reach.

An authenticated OpenShift web-console user with permission to add a Helm chart repository supplies a specially crafted chart URL pointing at an internal cluster address (e.g., the Kubernetes API, cloud metadata endpoint, or an internal service port). The console pod fetches the attacker-controlled URL on the user's behalf, and the resulting error messages or timing/response differences let the attacker disclose sensitive internal data or perform blind port scanning of the cluster. No public exploit identified at time of analysis.