CVE-2026-75885

Summary

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat OpenShift Container Platform 4.121790102793 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.171789939565 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.181789904865 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.191790095950 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.201790112153 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.211790142788 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.221790130905 < *unaffected

Weaknesses

  • CWE-918: Server-Side Request Forgery (SSRF)

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References