CVE-2026-75886: Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-10-01
Weakness: CWE-441

Description

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1789904865
Red Hat OpenShift Container Platform 4.17: all versions — fixed in 1789939565
Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1790095950
Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1790112153
Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1790142788
Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1790130905

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1789904865; Red Hat OpenShift Container Platform 4.17 1789939565; Red Hat OpenShift Container Platform 4.19 1790095950; Red Hat OpenShift Container Platform 4.20 1790112153; Red Hat OpenShift Container Platform 4.21 1790142788; Red Hat OpenShift Container Platform 4.22 1790130905. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-75886 or the next vulnerability affects your stack