Red Hat OpenShift EUVD-2026-56228

Exploitation requires that the victim is an authenticated OpenShift user who clicks a crafted OAuth grant URL and completes the approve-or-deny interaction on the grant page - this is the UI:R requirement. The attacker requires no account, privileges, or prior foothold on the OpenShift cluster. The 'then' parameter redirect only fires upon grant completion, so users who abandon the flow or do not interact with the link are unaffected. The vulnerability is present in the default OAuth server configuration; no special feature flag or non-default setting is required to be vulnerable. Exploitation is bounded to social-engineering downstream effects - the redirect itself grants the attacker no cluster access.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N scores this as Medium (4.3), accurately capturing that the attacker needs no authentication (PR:N) and faces no special conditions (AC:L), but cannot succeed without victim interaction (UI:R). The scope is unchanged (S:U) and direct impact is limited to Integrity:Low - the vulnerability itself causes a redirect, not data exfiltration. No EPSS score was provided in the input data, and the absence of a KEV listing and public POC keeps this in the 'real but not actively hunted' category. The practical risk, however, slightly exceeds the numeric score in environments where OpenShift cluster credentials carry high value: secondary phishing success could yield cluster access far beyond what the base CVSS reflects. There is no signal conflict in the available data - the CVSS vector is internally consistent with the description. The primary gap is the absence of a confirmed fixed version in the provided references.

An attacker constructs a legitimate-looking OpenShift OAuth authorization URL in which the 'then' parameter points to an attacker-controlled phishing domain that mimics the OpenShift or corporate login page. The attacker distributes this URL via spearphishing email or internal messaging to OpenShift users. When a recipient clicks the link, completes the OAuth grant interaction, and is redirected, the attacker's site harvests their credentials - which can then be used to access the OpenShift cluster directly. No public exploit code has been identified at time of analysis.