Skip to content
Fencer Vulns
high 7.5

CVE-2026-75887 json

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

published 2026-09-23 46 d ago modified 2026-10-23 16 d ago also EUVD-2026-85702

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 1790102793
  • Red Hat Red Hat OpenShift Container Platform 4.13 1791299243
  • Red Hat Red Hat OpenShift Container Platform 4.14 1790606051
  • Red Hat Red Hat OpenShift Container Platform 4.15 1791836468
  • Red Hat Red Hat OpenShift Container Platform 4.16 1790636171
  • Red Hat Red Hat OpenShift Container Platform 4.17 1789939565
  • Red Hat Red Hat OpenShift Container Platform 4.18 1789904865
  • Red Hat Red Hat OpenShift Container Platform 4.19 1790095950
  • Red Hat Red Hat OpenShift Container Platform 4.20 1790112153
  • Red Hat Red Hat OpenShift Container Platform 4.21 1790142788
  • Red Hat Red Hat OpenShift Container Platform 4.22 1790130905

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-75887 updated cvss 7.5

openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler

  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-console 1790102793
    fixed: vendor fix RHSA-2026:70647
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-console 1791299243
    fixed: vendor fix RHSA-2026:77321
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-console 1790606051
    fixed: vendor fix RHSA-2026:73869
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-console 1791836468
    fixed: vendor fix RHSA-2026:82813
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-console-rhel9 1790636171
    fixed: vendor fix RHSA-2026:73853
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-console-rhel9 1789939565
    fixed: vendor fix RHSA-2026:70587
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-console-rhel9 1789904865
    fixed: vendor fix RHSA-2026:70617
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-console-rhel9 1790095950
    fixed: vendor fix RHSA-2026:71447
show 4 more
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-console-rhel9 1790112153
    fixed: vendor fix RHSA-2026:71450
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-console-rhel9 1790142788
    fixed: vendor fix RHSA-2026:71453
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-console-rhel9 1790130905
    fixed: vendor fix RHSA-2026:71454
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli 1789911809, openshift4/ose-pod 1789911943, openshift4/ose-etcd 1789912378, openshift4/ose-tests 1789913848, openshift4/ose-coredns 1789911804, openshift4/ose-deployer 1789913062, +183 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli 1790804855, openshift4/ose-pod 1790804440, openshift4/ose-tests 1791299110, openshift4/ose-coredns 1790804538, openshift4/ose-deployer 1790805765, openshift4/ose-hyperkube 1790804816, +184 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1790603423, openshift4/ose-pod 1790605233, openshift4/ose-tests 1790606532, openshift4/ose-coredns 1790603521, openshift4/ose-deployer 1790606152, openshift4/ose-installer 1790604294, +189 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1791878476, openshift4/ose-tests 1791889482, openshift4/ose-deployer 1791888334, openshift4/ose-installer 1791889788, openshift4/ose-pod-rhel9 1791639781, openshift4/ose-sdn-rhel9 1791596191, +184 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1790629800, openshift4/ose-pod-rhel9 1790635011, openshift4/ose-sdn-rhel9 1790635203, openshift4/ose-etcd-rhel9 1790634844, openshift4/ose-tests-rhel9 1790636233, openshift4/ose-tools-rhel9 1790631517, +182 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1789938330, openshift4/ose-cli-rhel9 1789937904, openshift4/ose-pod-rhel9 1789937463, openshift4/ose-etcd-rhel9 1789937632, openshift4/ose-tests-rhel9 1790075131, openshift4/ose-tools-rhel9 1790073665, +180 more
    +5 more products
    Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1789904437, openshift4/ose-cli-rhel9 1789904386, openshift4/ose-pod-rhel9 1789906731, openshift4/ose-etcd-rhel9 1789906675, openshift4/ose-tests-rhel9 1790074104, openshift4/ose-tools-rhel9 1790072642, +180 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1789884391, openshift4/ose-cli-rhel9 1789896930, openshift4/ose-pod-rhel9 1789885260, openshift4/ose-etcd-rhel9 1789885218, openshift4/ose-tests-rhel9 1790074494, openshift4/ose-tools-rhel9 1790073159, +180 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1789887670, openshift4/ose-cli-rhel9 1789886242, openshift4/ose-pod-rhel9 1789888943, openshift4/ose-etcd-rhel9 1789900219, openshift4/ose-tests-rhel9 1789920053, openshift4/ose-tools-rhel9 1789883496, +182 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1789885447, openshift4/ose-cli-rhel9 1789885025, openshift4/ose-pod-rhel9 1789886631, openshift4/ose-etcd-rhel9 1789893973, openshift4/ose-tests-rhel9 1790134295, openshift4/ose-tools-rhel9 1790132809, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1790100943, openshift4/ose-cli-rhel9 1789994211, openshift4/ose-pod-rhel9 1790056647, openshift4/ose-etcd-rhel9 1790025313, openshift4/ose-tests-rhel9 1790010536, openshift4/ose-tools-rhel9 1789995349, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
45 d ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.