Skip to content
Red HatCVE-2026-50237

Red Hat OpenShift Console Helm catalog proxy: server-side request forgery

High7.4CVE-2026-50237 · Published Aug 11, 2026 · updated Sep 21, 2026

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Red Hat advisory

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.
Details and references

More Red Hat advisories

All Red Hat
Advisory
Red Hat FreeIPA: improper authorization
High8.2Aug 11
Red Hat search-v2-api. The authentication middleware: authentication bypass
High7.5Aug 11
Red Hat acm-search-v2-api-rhel9.: information disclosure
Medium5.3Aug 11
Red Hat insights-client.: information disclosure
High7.1Aug 11
Red Hat insights-client. A compromised managed cluster: information disclosure
Medium6.8Aug 11
Red Hat insights-client: secrets in logs
Medium6.3Aug 11

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.