CVE-2026-50237

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50237", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-06-04T12:11:18.430Z", "datePublished": "2026-08-11T11:23:55.079Z", "dateUpdated": "2026-09-21T15:52:56.923Z"}, "containers": {"cna": {"title": "Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console", "defaultStatus": "affected", "versions": [{"version": "1786511587", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.12::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console", "defaultStatus": "affected", "versions": [{"version": "1786477760", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.13::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console", "defaultStatus": "affected", "versions": [{"version": "1787056403", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console", "defaultStatus": "affected", "versions": [{"version": "1787028559", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787054159", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787631382", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786540776", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786486822", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786534931", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786574043", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.21::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift4/ose-console-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786607915", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.22::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54188", "name": "RHSA-2026:54188", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54206", "name": "RHSA-2026:54206", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54545", "name": "RHSA-2026:54545", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54555", "name": "RHSA-2026:54555", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54583", "name": "RHSA-2026:54583", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54602", "name": "RHSA-2026:54602", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54770", "name": "RHSA-2026:54770", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56789", "name": "RHSA-2026:56789", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56854", "name": "RHSA-2026:56854", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56912", "name": "RHSA-2026:56912", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60023", "name": "RHSA-2026:60023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50237", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746", "name": "RHBZ#2484746", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-11T09:47:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)", "workarounds": [{"lang": "en", "value": "Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{\"\\n\"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories."}], "timeline": [{"lang": "en", "time": "2026-04-29T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T09:47:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-21T15:52:56.923Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T17:41:09.111141Z", "id": "CVE-2026-50237", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:50:56.110Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50237", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:41:09.111141Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:41:10.262Z"}}], "cna": {"title": "Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console", "credits": [{"lang": "en", "value": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:openshift:4.12::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.12", "versions": [{"status": "unaffected", "version": "1786511587", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.13", "versions": [{"status": "unaffected", "version": "1786477760", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "1787056403", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "1787028559", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "1787054159", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "1787631382", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "1786540776", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "1786486822", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.2", "versions": [{"status": "unaffected", "version": "1786534931", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.21", "versions": [{"status": "unaffected", "version": "1786574043", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.22", "versions": [{"status": "unaffected", "version": "1786607915", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift4/ose-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-04-29T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-11T09:47:00.000Z", "value": "Made public."}], "datePublic": "2026-08-11T09:47:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:54188", "name": "RHSA-2026:54188", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54206", "name": "RHSA-2026:54206", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54545", "name": "RHSA-2026:54545", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54555", "name": "RHSA-2026:54555", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54583", "name": "RHSA-2026:54583", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54602", "name": "RHSA-2026:54602", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54770", "name": "RHSA-2026:54770", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56789", "name": "RHSA-2026:56789", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56854", "name": "RHSA-2026:56854", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56912", "name": "RHSA-2026:56912", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:60023", "name": "RHSA-2026:60023", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-50237", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746", "name": "RHBZ#2484746", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{\"\\n\"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-07T17:09:27.179Z"}, "x_redhatCweChain": "CWE-918: Server-Side Request Forgery (SSRF)"}}, "cveMetadata": {"cveId": "CVE-2026-50237", "state": "PUBLISHED", "dateUpdated": "2026-09-07T17:09:27.179Z", "dateReserved": "2026-06-04T12:11:18.430Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-11T11:23:55.079Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.12::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console", "product": "Red Hat OpenShift Container Platform 4.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786511587", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.13::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console", "product": "Red Hat OpenShift Container Platform 4.13", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786477760", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console", "product": "Red Hat OpenShift Container Platform 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787056403", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console", "product": "Red Hat OpenShift Container Platform 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787028559", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787054159", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787631382", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786540776", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786486822", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786534931", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.21::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.21", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786574043", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift:4.22::el9"], "defaultStatus": "affected", "packageName": "openshift4/ose-console-rhel9", "product": "Red Hat OpenShift Container Platform 4.22", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786607915", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."}, {"lang": "es", "value": "Se encontr\u00f3 una falsificaci\u00f3n de petici\u00f3n del lado del servidor y un fallo en la cadena de suministro en el proxy del cat\u00e1logo Helm de OpenShift Console. Un inquilino de espacio de nombres puede introducir un ProjectHelmChartRepository con una URL arbitraria que el pod de la consola obtiene del lado del servidor, eludiendo las restricciones de salida del inquilino. Combinado con el envenenamiento de metadatos del cat\u00e1logo y la instalaci\u00f3n de gr\u00e1ficos mediada por el administrador, esto permite la escalada de privilegios."}], "id": "CVE-2026-50237", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 3.7, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50237", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T17:41:09.111141Z", "version": "2.0.3"}}]}, "published": "2026-08-11T12:17:38.347", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54188"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54206"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54545"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54555"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54583"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54602"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:54770"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:56789"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:56854"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:56912"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:60023"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-50237"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Christopher Lusk (North Echo Security Research) for reporting this issue.", "bugzilla": {"description": "openshift/console: Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console", "id": "2484746", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484746"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-918", "details": ["A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation."], "mitigation": {"lang": "en:us", "value": "Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{\"\\n\"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories."}, "name": "CVE-2026-50237", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/ose-console-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-11T09:47:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50237\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50237"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "Red Hat OpenShift Container Platform 4", "source": "cna", "vendor": "Red Hat"}, "product": "openshift_container_platform", "vendor": "redhat"}], "created": "2026-08-11T17:15:06.752558+00:00", "updated": "2026-08-13T10:45:03.810718+00:00", "vendors": ["redhat", "redhat$PRODUCT$openshift_container_platform"]}