CVE-2026-50237: OpenShift Console Helm SSRF Vulnerability

CVE-2026-50237 Overview

CVE-2026-50237 is a Server-Side Request Forgery (SSRF) and supply chain vulnerability in the Red Hat OpenShift Console Helm catalog proxy. A namespace tenant can register a ProjectHelmChartRepository custom resource containing an arbitrary URL. The console pod then fetches that URL server-side, using the pod's network position rather than the tenant's. This behavior bypasses tenant egress restrictions and exposes internal cluster services. When combined with catalog metadata poisoning and admin-mediated chart installation, the flaw enables privilege escalation across tenant boundaries. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
A low-privileged namespace tenant can coerce the OpenShift Console into issuing arbitrary outbound HTTP requests and can plant poisoned Helm chart metadata that leads to cross-tenant privilege escalation.

Affected Products

Red Hat OpenShift Console (Helm catalog proxy component)
Deployments exposing the ProjectHelmChartRepository custom resource to tenants
OpenShift clusters relying on namespace-scoped egress restrictions for tenant isolation

Discovery Timeline

2026-08-11 - CVE-2026-50237 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-50237

Vulnerability Analysis

The OpenShift Console exposes a proxy endpoint that renders Helm chart catalogs for tenants. When a tenant creates a ProjectHelmChartRepository, the console reads the specified URL and fetches catalog metadata on the tenant's behalf. The fetch executes inside the console pod, which typically runs with broader network reachability than any single tenant workload.

Because the URL is attacker-controlled and the console does not restrict the destination, the request can target internal services, cloud metadata endpoints, or arbitrary external hosts. This is the classic SSRF primitive described by CWE-918.

The supply chain dimension amplifies impact. A tenant can host a repository that returns crafted index.yaml content pointing to poisoned charts. If a cluster administrator later installs a chart from that catalog, the poisoned templates execute with the administrator's privileges, resulting in privilege escalation across tenant boundaries.

Root Cause

The root cause is missing validation and egress policy enforcement on the destination URL supplied through ProjectHelmChartRepository. The console proxy trusts tenant-provided input and does not restrict fetches to an allowlist, filter internal address ranges, or attribute the outbound request to the tenant's network policy.

Attack Vector

An authenticated tenant with permission to create ProjectHelmChartRepository objects submits a resource pointing to an attacker-controlled or internal URL. The console pod issues a server-side HTTP request to that URL and returns response data through the catalog interface. For privilege escalation, the attacker returns crafted chart metadata that a cluster administrator subsequently installs.

No verified exploitation code is publicly available. Refer to the Red Hat CVE-2026-50237 Advisory and Red Hat Bugzilla Report #2484746 for vendor technical details.

Detection Methods for CVE-2026-50237

Indicators of Compromise

Creation of ProjectHelmChartRepository resources referencing URLs outside expected repository domains, internal RFC1918 ranges, or cloud metadata endpoints such as 169.254.169.254.
Outbound HTTP requests from the openshift-console pod to hosts not present in the organization's approved Helm registry list.
Helm chart installations by cluster administrators sourced from tenant-created ProjectHelmChartRepository catalogs.

Detection Strategies

Audit Kubernetes API server logs for create and update events on ProjectHelmChartRepository resources, correlating the URL field with an approved repository allowlist.
Inspect network flow telemetry from console pods for unusual destinations, including internal service IPs and metadata endpoints.
Review Helm release manifests for template content or hooks that reference privileged service accounts, cluster-role bindings, or arbitrary command execution.

Monitoring Recommendations

Forward OpenShift audit logs and console pod egress telemetry to a centralized data lake for correlation across tenants.
Alert on any successful HTTP response returned by the console proxy for a destination outside the approved catalog domain list.
Track administrator-driven chart installs and record the originating repository URL for post-incident review.

How to Mitigate CVE-2026-50237

Immediate Actions Required

Apply the fixed OpenShift Console build referenced in the Red Hat CVE-2026-50237 Advisory as soon as it is available for your channel.
Restrict the RBAC verbs create, update, and patch on ProjectHelmChartRepository to trusted namespaces and service accounts only.
Audit existing ProjectHelmChartRepository objects across all namespaces and remove entries pointing to unapproved URLs.

Patch Information

Red Hat is tracking the fix under Bugzilla #2484746 and the Red Hat CVE-2026-50237 Advisory. Administrators should consult the advisory for the specific OpenShift Console container image tags and errata that contain the destination validation fix.

Workarounds

Enforce a NetworkPolicy or egress firewall rule limiting the openshift-console pod to the set of approved Helm chart repository hostnames.
Block console egress to link-local, loopback, and cluster-internal service ranges, including 169.254.0.0/16 and internal ClusterIP subnets.
Require cluster administrators to install charts only from cluster-scoped HelmChartRepository sources reviewed by the platform team, not from tenant-supplied ProjectHelmChartRepository catalogs.

bash

# Example NetworkPolicy restricting console egress to approved Helm registries
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: console-egress-allowlist
  namespace: openshift-console
spec:
  podSelector:
    matchLabels:
      app: console
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.0.0/16
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - protocol: TCP
          port: 443