CVE-2026-75886
Received Received - Intake

Unauthenticated CatalogdHandler Access in OpenShift Console

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-75886

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat openshift_console *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the OpenShift console where an unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler. The issue involves the lack of proper authentication and the forwarding of the openshift-session-token cookie, allowing the attacker to send requests to the in-cluster catalogd service. This leads to disclosure of the internal operator-catalog index and provides access to the openshift-catalogd namespace.

Impact Analysis

An attacker could gain unauthorized access to internal catalog information, potentially exposing sensitive data about operators and services. They might also use this as a relay point to move laterally within the cluster, increasing the risk of further compromise or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches, lack of proper access controls, and insufficient authentication mechanisms.

Mitigation Strategies

Apply the latest patches or updates from Red Hat for OpenShift Console to fix the misconfiguration in CatalogdHandler. Ensure proper authentication is enforced for all in-cluster services and review cookie handling policies to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart