CVE-2026-50236

Summary

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat OpenShift Container Platform 4.141787056403 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.151787028559 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.161787054159 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.171787631382 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.181786540776 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.191786486822 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.201786534931 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.211786574043 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.221786607915 < *unaffected

Weaknesses

  • CWE-918: Server-Side Request Forgery (SSRF)

Workarounds

Apply NetworkPolicy egress restrictions to the openshift-console namespace to limit the console pod's outbound connectivity to required endpoints only (Kubernetes API server, OAuth server, monitoring). Note that a blanket default-deny egress policy will break console functionality. Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values pointing to internal addresses or containing query separators.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References