CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888

A flaw in the OpenShift console allows an authenticated user to perform a Server-Side Request Forgery (SSRF) . By providing a specially crafted Helm chart URL that lacks proper validation, an attacker can force the console pod to fetch arbitrary URLs. This vulnerability could lead to the disclosu...

EUVD-2026-97562

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888 Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

PT-2026-110799

Name of the Vulnerable Software and Affected Versions OpenShift console affected versions not specified Description An authenticated user can exploit a Server-Side Request Forgery SSRF flaw by providing a specially crafted Helm chart URL. Due to a lack of proper validation, the console pod can be...

CVE-2026-75888: Server-Side Request Forgery (SSRF)

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

CVE-2026-29954

In KubePlus 4.1.4 , the mutating webhook and kubeconfiggenerator components are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the chartURL field in ResourceComposition resources. Furthermore, because the kubeconfiggenerator directly concatenates this field int...

KubePlus security vulnerabilities

KubePlus is a Kubernetes multi-tenant application management platform developed by cloud-ark. KubePlus 4.1.4 contains security vulnerabilities, which stem from server-side request forgery and command injection during the processing of the chartURL field by the mutating webhook and...