CVE-2026-50237
Received Received - Intake

Server-Side Request Forgery in OpenShift Console Helm Catalog Proxy

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Red Hat, Inc.

Description
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-50237
EUVD
EUVD-2026-56132

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat openshift_console From 2026-06-04 (inc) to 2026-08-11 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) and supply chain flaw in the OpenShift Console Helm catalog proxy. A namespace tenant with edit permissions can create a ProjectHelmChartRepository resource with a malicious URL. The OpenShift Console pod then fetches this URL server-side without proper validation, bypassing egress restrictions. The tenant can also inject malicious chart metadata and credentials, enabling privilege escalation when an admin installs the chart.

Detection Guidance

Check for unexpected ProjectHelmChartRepository resources with arbitrary URLs in your cluster. Use commands like 'oc get projecthelmchartrepository --all-namespaces' to list them. Inspect the spec.connectionConfig.url field for suspicious or external URLs. Review Helm catalog metadata for spoofed trust annotations or malicious chart entries.

Impact Analysis

If you are a namespace tenant with edit permissions, you could exploit this to access internal systems, poison the Helm catalog with malicious charts, or degrade service availability. If you are a cluster administrator, an attacker could trick you into installing a malicious chart, leading to privilege escalation and potential compromise of cluster resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Privilege escalation may result in unauthorized modifications to systems, breaching integrity and access control mandates. Organizations must address this to maintain compliance with data protection and security standards.

Mitigation Strategies

Apply NetworkPolicy egress restrictions to the openshift-console namespace to block outbound connections to private networks. Review and remove any unauthorized ProjectHelmChartRepository resources. Disable ProjectHelmChartRepository creation via RBAC if not required. Verify chart provenance before installation and avoid installing charts from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart