What’s Vulnerable › Vulnerabilities

CVE-2026-50236: Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-24
• Weakness: CWE-918

Description

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1786540776
• Red Hat OpenShift Container Platform 4.14: all versions — fixed in 1787056403
• Red Hat OpenShift Container Platform 4.15: all versions — fixed in 1787028559
• Red Hat OpenShift Container Platform 4.16: all versions — fixed in 1787054159
• Red Hat OpenShift Container Platform 4.17: all versions — fixed in 1787631382
• Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1786486822
• Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1786534931
• Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1786574043
• Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1786607915

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1786540776; Red Hat OpenShift Container Platform 4.14 1787056403; Red Hat OpenShift Container Platform 4.15 1787028559; Red Hat OpenShift Container Platform 4.16 1787054159; Red Hat OpenShift Container Platform 4.17 1787631382; Red Hat OpenShift Container Platform 4.19 1786486822; Red Hat OpenShift Container Platform 4.20 1786534931; Red Hat OpenShift Container Platform 4.21 1786574043; Red Hat OpenShift Container Platform 4.22 1786607915. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:54545
• https://access.redhat.com/errata/RHSA-2026:54555
• https://access.redhat.com/errata/RHSA-2026:54583
• https://access.redhat.com/errata/RHSA-2026:54602
• https://access.redhat.com/errata/RHSA-2026:54770
• https://access.redhat.com/errata/RHSA-2026:56789
• https://access.redhat.com/errata/RHSA-2026:56854
• https://access.redhat.com/errata/RHSA-2026:56912
• https://access.redhat.com/errata/RHSA-2026:60023
• https://access.redhat.com/security/cve/CVE-2026-50236
• https://bugzilla.redhat.com/show_bug.cgi?id=2484745

Get alerted when CVE-2026-50236 or the next vulnerability affects your stack