Vulnerability details
CVE-2026-50236
Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console
CVSS 3.1
7.4High
Official description
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.4High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| No product information recorded. | |||
References and advisories
11- https://access.redhat.com/errata/RHSA-2026:54545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54555 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54583 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54602 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54770 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56789 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56854 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56912 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60023 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-50236 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2484745 issue-trackingx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-11
- Last updated
- 2026-09-21
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
41%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)