CVE-2026-50236
Received Received - Intake

Authenticated SSRF in OpenShift Console Dev Console Webhook Helpers

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-50236
EUVD
EUVD-2026-56133

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat enterprise_linux 8
red_hat openshift_container_platform 4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50236 is an authenticated Server-Side Request Forgery (SSRF) vulnerability in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, allowing attackers to target arbitrary endpoints and receive full responses from the console pod's privileged network position.

Detection Guidance

Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values or query separators. Check for requests to internal endpoints or unexpected domains.

Impact Analysis

An attacker with console access could exploit this to reach internal cluster services, send arbitrary POST requests, and receive full HTTP responses including headers and body. This could lead to data exfiltration, unauthorized access to sensitive services, or further network pivoting within the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of personal health information, or other regulated data, potentially leading to compliance violations and regulatory penalties.

Mitigation Strategies

Apply NetworkPolicy egress restrictions in the openshift-console namespace to limit outbound connectivity to only necessary endpoints like the Kubernetes API server, OAuth server, and monitoring services. Avoid default-deny policies as they may disrupt console functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart