CVE-2026-50236

Published: Aug 11, 2026Modified: Aug 19, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Exploitability: 3.1 / Impact: 3.7

Source: secalert@redhat.com (Secondary)

Description

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://access.redhat.com/errata/RHSA-2026:54583

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:54602

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:54770

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-50236

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2484745

Source: secalert@redhat.com

Timeline

No history available yet.