CVE-2026-75888
HIGHCVSS 7.7Description
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
Timeline
Published:October 12th, 2026 5:17 PM
Last modified:October 30th, 2026 5:16 AM
CVSS Scoring
CVSS v3: 7.7 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://access.redhat.com/errata/RHSA-2026:82785
- https://access.redhat.com/errata/RHSA-2026:82813
- https://access.redhat.com/errata/RHSA-2026:83480
- https://access.redhat.com/errata/RHSA-2026:83502
- https://access.redhat.com/errata/RHSA-2026:83541
- https://access.redhat.com/errata/RHSA-2026:83702
- https://access.redhat.com/errata/RHSA-2026:89715
- https://access.redhat.com/errata/RHSA-2026:89726
- https://access.redhat.com/errata/RHSA-2026:90274
- https://access.redhat.com/security/cve/CVE-2026-75888
- https://bugzilla.redhat.com/show_bug.cgi?id=2517888
Source: NIST NVD · Data may lag official sources by up to one minute