Advisoriesby IbisRed HatCVE-2026-50236
Red Hat OpenShift Console: server-side request forgery
No fix yet
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-918
- www.cve.org/CVERecord?id=CVE-2026-50236
- nvd.nist.gov/vuln/detail/CVE-2026-50236
- access.redhat.com/errata/RHSA-2026:54545
- access.redhat.com/errata/RHSA-2026:54555
- access.redhat.com/errata/RHSA-2026:54583
- access.redhat.com/errata/RHSA-2026:54602
- access.redhat.com/errata/RHSA-2026:54770
- access.redhat.com/errata/RHSA-2026:56789
- access.redhat.com/errata/RHSA-2026:56854
- access.redhat.com/errata/RHSA-2026:56912
- access.redhat.com/errata/RHSA-2026:60023
- access.redhat.com/security/cve/CVE-2026-50236
- bugzilla.redhat.com/show_bug.cgi?id=2484745