CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

EUVD-2026-56133

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236 Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236

The CVE-2026-50236 issue affects OpenShift OpenShift Console Dev Console webhook helpers, where authenticated users can trigger SSRF by supplying target URLs that are fetched server-side without validation. The underlying flaw enables path neutralization that can target arbitrary endpoints and re...

EUVD-2026-56132

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50237

Summary: CVE-2026-50237 affects the OpenShift Console Helm catalog proxy. A namespace tenant can create a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress controls. This, combined with catalog metadata poisoning and admin‑mediated ...

CVE-2026-50237 Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50237 Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2026-50237: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-50236: Server-Side Request Forgery (SSRF)

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

PT-2026-70151

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description An authenticated Server-Side Request Forgery SSRF flaw exists in the OpenShift Console Dev Console webhook helpers. The system fetches user-supplied target URLs server-side without...

PT-2026-70152

Name of the Vulnerable Software and Affected Versions OpenShift Console affected versions not specified Description A Server-Side Request Forgery SSRF and supply chain flaw exists in the OpenShift Console Helm catalog proxy. A namespace tenant can create a ProjectHelmChartRepository using an...

CVE-2026-44762: Improper Restriction of Rendered UI Layers or Frames

SAP Data Services Management Console allows an overly permissive Content Security Policy CSP configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicio...

CVE-2026-66806

A flaw was found in console. When the HTTPSPROXY environment variable is not configured, the console component fails to verify Transport Layer Security TLS certificates for outbound connections. A network-positioned attacker Man-in-the-Middle can exploit this vulnerability to intercept the cluste...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736 PingFederate Administrative Console CSRF weaknesses

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...