CVE-2026-50237
Full vulnerability record from the local CVENow database.
Description
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
Severity
HIGH
CVSS score
7.4
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-11 12:17:38.347000
Last modified
2026-10-24 16:10:00.153000
View original CVE JSON
{
"id": "CVE-2026-50237",
"sourceIdentifier": "[email protected]",
"published": "2026-08-11T12:17:38.347",
"lastModified": "2026-10-24T16:10:00.153",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."
},
{
"lang": "es",
"value": "Se encontró una falsificación de petición del lado del servidor y un fallo en la cadena de suministro en el proxy del catálogo Helm de OpenShift Console. Un inquilino de espacio de nombres puede introducir un ProjectHelmChartRepository con una URL arbitraria que el pod de la consola obtiene del lado del servidor, eludiendo las restricciones de salida del inquilino. Combinado con el envenenamiento de metadatos del catálogo y la instalación de gráficos mediada por el administrador, esto permite la escalada de privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.12",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el9"
],
"versions": [
{
"version": "1786511587",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.13",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"versions": [
{
"version": "1786477760",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.14",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"versions": [
{
"version": "1787056403",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"versions": [
{
"version": "1787028559",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"versions": [
{
"version": "1787054159",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"versions": [
{
"version": "1787631382",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.18",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"versions": [
{
"version": "1786540776",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.19",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"versions": [
{
"version": "1786486822",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.20",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"versions": [
{
"version": "1786534931",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.21",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"versions": [
{
"version": "1786574043",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.22",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"versions": [
{
"version": "1786607915",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.1,
"impactScore": 3.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-11T17:41:09.111141Z",
"id": "CVE-2026-50237",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:54188",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54206",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54545",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54555",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54583",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54602",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54770",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:56789",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:56854",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:56912",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:60023",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50237",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746",
"source": "[email protected]"
}
]
}