CVE-2026-50237Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console

Description

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Timeline

Scores

EPSS (exploitation in 30 days)

0.47% · top 59% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Affected products

• Red Hat · Red Hat OpenShift Container Platform 4.12

  • unaffected 1786511587 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.13

  • unaffected 1786477760 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.14

  • unaffected 1787056403 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.15

  • unaffected 1787028559 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.16

  • unaffected 1787054159 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.17

  • unaffected 1787631382 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.18

  • unaffected 1786540776 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.19

  • unaffected 1786486822 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.20

  • unaffected 1786534931 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.21

  • unaffected 1786574043 – < *

• Red Hat · Red Hat OpenShift Container Platform 4.22

  • unaffected 1786607915 – < *

What to do

Workaround: Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{"\n"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-56132 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-50237](https://cveledger.app/badge/CVE-2026-50237.svg)](https://cveledger.app/cve/CVE-2026-50237)

Record last updated 21 Sept 2026, 15:52 UTC.