A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity from

no source yet

Weakness

CWE-22

• www.cve.org/CVERecord?id=CVE-2026-75887
• nvd.nist.gov/vuln/detail/CVE-2026-75887
• access.redhat.com/security/cve/CVE-2026-75887
• bugzilla.redhat.com/show_bug.cgi?id=2517889