Skip to content
Fencer Vulns
high 7.4

CVE-2026-50237 json

Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

published 2026-08-11 2 mo ago modified 2026-10-24 15 d ago also EUVD-2026-56132

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 1786511587
  • Red Hat Red Hat OpenShift Container Platform 4.13 1786477760
  • Red Hat Red Hat OpenShift Container Platform 4.14 1787056403
  • Red Hat Red Hat OpenShift Container Platform 4.15 1787028559
  • Red Hat Red Hat OpenShift Container Platform 4.16 1787054159
  • Red Hat Red Hat OpenShift Container Platform 4.17 1787631382
  • Red Hat Red Hat OpenShift Container Platform 4.18 1786540776
  • Red Hat Red Hat OpenShift Container Platform 4.19 1786486822
  • Red Hat Red Hat OpenShift Container Platform 4.20 1786534931
  • Red Hat Red Hat OpenShift Container Platform 4.21 1786574043
  • Red Hat Red Hat OpenShift Container Platform 4.22 1786607915

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-50237 updated cvss 7.4

openshift/console: Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console

  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-console 1786511587
    fixed: vendor fix RHSA-2026:54206
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-console 1786477760
    fixed: vendor fix RHSA-2026:54188
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console 1787056403
    fixed: vendor fix RHSA-2026:56789
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-console 1787028559
    fixed: vendor fix RHSA-2026:56912
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9 1787054159
    fixed: vendor fix RHSA-2026:56854
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9 1787631382
    fixed: vendor fix RHSA-2026:60023
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9 1786540776
    fixed: vendor fix RHSA-2026:54545
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1786486822
    fixed: vendor fix RHSA-2026:54555
show 4 more
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1786534931
    fixed: vendor fix RHSA-2026:54583
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1786574043
    fixed: vendor fix RHSA-2026:54602
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1786607915
    fixed: vendor fix RHSA-2026:54770
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli 1786458728, openshift4/ose-pod 1786458850, openshift4/ose-etcd 1786458674, openshift4/ose-tests 1786461085, openshift4/ose-coredns 1786458726, openshift4/ose-deployer 1786460215, +183 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli 1786477847, openshift4/ose-pod 1786477900, openshift4/ose-tests 1786480143, openshift4/ose-coredns 1786477624, openshift4/ose-deployer 1786479204, openshift4/ose-hyperkube 1786485473, +184 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1787001024, openshift4/ose-pod 1787000960, openshift4/ose-tests 1787003927, openshift4/ose-coredns 1787002405, openshift4/ose-deployer 1787002762, openshift4/ose-installer 1787001880, +191 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1787028201, openshift4/ose-tests 1787031287, openshift4/ose-deployer 1787030550, openshift4/ose-installer 1787037007, openshift4/ose-pod-rhel9 1787056429, openshift4/ose-sdn-rhel9 1787055135, +186 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1786785721, openshift4/ose-pod-rhel9 1786788191, openshift4/ose-sdn-rhel9 1786788280, openshift4/ose-etcd-rhel9 1786787038, openshift4/ose-tools-rhel9 1786784972, openshift4/ose-ironic-rhel9 1787053253, +183 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1787543472, openshift4/ose-cli-rhel9 1787549445, openshift4/ose-pod-rhel9 1787548386, openshift4/ose-etcd-rhel9 1787551063, openshift4/ose-tests-rhel9 1787549986, openshift4/ose-tools-rhel9 1787547280, +182 more
    +5 more products
    Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1786500774, openshift4/ose-cli-rhel9 1786499586, openshift4/ose-pod-rhel9 1786531550, openshift4/ose-etcd-rhel9 1786501036, openshift4/ose-tests-rhel9 1786517189, openshift4/ose-tools-rhel9 1786501815, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1786486841, openshift4/ose-cli-rhel9 1786489910, openshift4/ose-pod-rhel9 1786491291, openshift4/ose-etcd-rhel9 1786486889, openshift4/ose-tests-rhel9 1786491543, openshift4/ose-tools-rhel9 1786486870, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1786493981, openshift4/ose-cli-rhel9 1786494900, openshift4/ose-pod-rhel9 1786498817, openshift4/ose-etcd-rhel9 1786494149, openshift4/ose-tests-rhel9 1786545242, openshift4/ose-tools-rhel9 1786543651, +183 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1786497121, openshift4/ose-cli-rhel9 1786496647, openshift4/ose-pod-rhel9 1786502473, openshift4/ose-etcd-rhel9 1786497722, openshift4/ose-tests-rhel9 1786526472, openshift4/ose-tools-rhel9 1786524417, +180 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1786583427, openshift4/ose-cli-rhel9 1786583327, openshift4/ose-pod-rhel9 1786606091, openshift4/ose-etcd-rhel9 1786549839, openshift4/ose-tests-rhel9 1786607829, openshift4/ose-tools-rhel9 1786602789, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.