EUVD-2026-85665
GHSA-f8rq-4f8p-cmww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed OpenShift Console endpoint
-
DeliverySend request to unauthenticated CatalogdHandler
-
ExploitHandler forwards session-token cookie to catalogd
-
ExecutionRelay reaches in-cluster catalogd service
-
ImpactDisclose operator-catalog index and pivot into namespace
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service Proxy/intermediary controls
|
| Exploitation Conditions | Exploitation requires network reachability to the OpenShift Console's CatalogdHandler endpoint, which lacks authentication and forwards the openshift-session-token cookie to the in-cluster catalogd service. No credentials, privileges, or user interaction are needed (PR:N/UI:N). Realistic exploitation is limited by whether the console endpoint is exposed to the attacker (internet-facing ingress vs. internal/VPN-only), and the impact ceiling is disclosure of the operator-catalog index and a request relay into the openshift-catalogd namespace rather than direct secret theft or code execution (C:L/I:L/A:N). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes the most attacker-friendly access profile: network-reachable, low complexity, no privileges, no user interaction, with a scope change reflecting that the OpenShift Console (the confused deputy) is abused to reach a distinct security authority - the in-cluster catalogd service in the openshift-catalogd namespace. This is internally consistent with the description of an unauthenticated CatalogdHandler that forwards the openshift-session-token cookie, and the CWE-441 (unintended proxy/confused deputy) classification is apt. However, actual impact is bounded: C:L/I:L/A:N and the description limit the outcome to disclosure of the internal operator-catalog index plus a request relay, not full read/write of cluster secrets or code execution - so this is a genuine but moderate exposure, not a crown-jewels compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided in the input, so exploitation likelihood cannot be quantified from these sources; there is no public exploit identified at time of analysis. Notably, real-world reachability depends on whether the OpenShift Console/web endpoint is exposed beyond the cluster perimeter - many OpenShift consoles sit behind ingress/VPN restrictions, which tempers the AV:N reading in practice. Priority should be treated as real-but-moderate: patch on normal cadence, prioritized higher where the console is internet-facing. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the OpenShift Console endpoint sends crafted requests to the CatalogdHandler, which fails to authenticate the caller and forwards the openshift-session-token cookie to the in-cluster catalogd service. The attacker thereby retrieves the internal operator-catalog index and obtains a relay foothold into the openshift-catalogd namespace. No public exploit code was identified in the provided data, and no user interaction or credentials are required per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Improper authentication in the OpenShift Console's CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie and send requests to the in-cluster catalogd service, disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace (CVE-2026-75886, CVSS 7.2). This affects Red Hat OpenShift Container Platform 4. No public exploit identified at time of analysis; exploitation requires network reachability to the exposed console endpoint.
RemediationAI
Patch status is not specified in the provided intelligence; refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-75886 for an official fix. In the absence of a confirmed patch, implement compensating controls: restrict network access to the OpenShift Console's CatalogdHandler endpoint to trusted networks only (e.g., internal/VPN-only), since exploitation requires network reachability to the exposed console. If the console is internet-facing, place an authenticating reverse proxy in front of it or disable external access to the CatalogdHandler route. Monitor logs for anomalous requests to the catalogd service. Trade-offs: network restrictions may impede legitimate administrative access from remote locations; an authenticating proxy adds management overhead and may not be compatible with all console features. Do not expose the console endpoint to untrusted networks without additional authentication.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-441 (Unintended Proxy or Intermediary, 'Confused Deputy'). The OpenShift Console acts as a deputy with access to the in-cluster catalogd service, but the CatalogdHandler endpoint lacks proper authentication checks. An unauthenticated attacker can send requests to this endpoint, and the console forwards the openshift-session-token cookie to the catalogd service, effectively relaying the attacker's requests. This allows the attacker to read the internal operator-catalog index and interact with the openshift-catalogd namespace. The CPE data identifies Red Hat OpenShift Container Platform 4 as the affected product, with the vulnerability residing in the openshift/console component. The scope change (S:C) in the CVSS vector reflects that the console's authority is misused to reach a separate security authority (catalogd). Impact is limited to information disclosure and a request relay (C:L/I:L/A:N), not direct code execution or secret theft.
Know when Openshift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network access to an endpoint that lacks auth (PR:N/UI:N/AC:L); confused-deputy relay crosses into another service (S:C) with limited index disclosure and relay impact (C:L/I:L, A:N).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
Executive ViewAI
A high-severity flaw in Red Hat OpenShift Container Platform 4's Console component allows attackers who can reach the console endpoint to relay requests into the internal catalogd service, exposing the operator-catalog index and opening a path into the openshift-catalogd namespace. Because no vendor patch is currently available, every internet- or broadly reachable OpenShift console in the estate represents an unmitigated exposure that could reveal platform internals and serve as a foothold for further lateral movement. Security and platform leadership should treat this as a priority containment exercise, driven by network exposure reduction rather than patching, until Red Hat ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the OpenShift Console so only trusted management networks, VPN, or identity-aware proxies can connect; place the console behind an authenticating reverse proxy or bastion; apply network policies that limit which workloads can reach the catalogd service and the openshift-catalogd namespace; enable and monitor audit logging for console and catalogd requests; review and minimize RBAC in the openshift-catalogd namespace; and rotate session tokens or credentials suspected of exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to ex
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remot
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2,
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive j
The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which mig
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitr
Exploit-DB