EUVD-2026-85702

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75887

A path traversal vulnerability exists in the OpenShift console within the i18n locale handler . An unauthenticated attacker can manipulate the lng and ns query parameters in the /locales/resource.json endpoint to read sensitive *.json files from the pod filesystem, such as configuration files and...

CVE-2026-75887 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886 Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.2 release.

Red Hat Web Terminal Operator 1.16.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.1 release.

Red Hat Web Terminal Operator 1.17.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.15.2 release.

Red Hat Web Terminal Operator 1.15.2 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.1 release.

Red Hat Web Terminal Operator 1.14.1 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...

EUVD-2026-83454

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-75885

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-75885 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-75885

A flaw in the OpenShift console allows unauthenticated remote attackers to exploit the /api/devfile/ and /api/devfile/samples/ endpoints. Two distinct impacts are possible: Server-Side Request Forgery (SSRF) , where the console pod makes requests to internal services and reflects partial response...

CVE-2026-75885 Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-75885

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

Important: Red Hat Security Advisory: Red Hat Web Terminal Operator 1.14.0 release.

Red Hat Web Terminal Operator 1.14.0 has been released. The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed...