CVE-2026-75885: OpenShift Console SSRF Vulnerability

CVE-2026-75885 Overview

A flaw in the OpenShift console exposes the /api/devfile/ and /api/devfile/samples/ endpoints to unauthenticated remote attackers. Attackers can send crafted devfile payloads that cause the console pod to issue Server-Side Request Forgery (SSRF) requests to internal services. The console reflects partial responses back to the attacker, enabling reconnaissance of internal infrastructure. The same endpoints accept large requests without a specified content length, allowing an attacker to trigger unbounded memory growth and cause a Denial of Service (DoS). The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can probe internal cluster services via SSRF and exhaust OpenShift console pod memory to trigger service outages.

Affected Products

Red Hat OpenShift Container Platform (console component)
OpenShift console /api/devfile/ endpoint
OpenShift console /api/devfile/samples/ endpoint

Discovery Timeline

2026-09-18 - CVE-2026-75885 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-75885

Vulnerability Analysis

The OpenShift console exposes two devfile-related HTTP endpoints without requiring authentication. Both endpoints accept attacker-supplied payloads that influence outbound network requests made by the console pod. Because the console runs inside the cluster network, its outbound requests can reach internal APIs, metadata services, and workloads that are otherwise unreachable from outside the cluster. Partial response reflection allows attackers to enumerate services and infer their behavior. The second failure mode occurs when the endpoints accept requests without validating or bounding the content length, producing unbounded in-memory buffering.

Root Cause

The root cause is twofold. First, the console fails to authenticate requests to the devfile endpoints, contrary to the console's standard access model. Second, devfile payload processing does not restrict or validate outbound request targets, satisfying the conditions for CWE-918. Missing content-length enforcement and lack of streaming bounds compound the issue by allowing memory to grow without limit.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /api/devfile/ or /api/devfile/samples/ on an exposed OpenShift console. For SSRF, the payload references an internal URL such as a cluster service endpoint or the cloud metadata service. The console fetches the URL and returns partial content to the attacker. For DoS, the attacker sends repeated large-body requests without a Content-Length header, causing the console pod to buffer data until it exhausts available memory. See the Red Hat CVE-2026-75885 Advisory for vendor-specific technical detail.

No verified public exploit code is available. The vulnerability mechanism is described in prose above based on the Red Hat Bug Report #2517885.

Detection Methods for CVE-2026-75885

Indicators of Compromise

Unauthenticated HTTP requests to /api/devfile/ or /api/devfile/samples/ paths in OpenShift console access logs
Outbound requests from the console pod to internal service IPs, cluster DNS names, or 169.254.169.254 metadata endpoints
Repeated large POST requests to devfile endpoints lacking a Content-Length header
Console pod memory usage climbing rapidly toward container limits followed by OOMKilled events

Detection Strategies

Enable and centralize OpenShift console access logging and audit unusual request patterns against /api/devfile/*
Correlate console pod egress traffic with expected devfile registry destinations; alert on internal-range destinations
Monitor Kubernetes events for console pod restarts, OOMKilled status, and memory-pressure conditions

Monitoring Recommendations

Ingest OpenShift audit logs and console pod logs into a central SIEM or data lake for retention and correlation
Track baseline memory and CPU for the console pod and alert on sustained deviation
Alert on any unauthenticated request that returns a non-error status from /api/devfile/ endpoints

How to Mitigate CVE-2026-75885

Immediate Actions Required

Apply the fixed OpenShift console build referenced in the Red Hat CVE-2026-75885 Advisory as soon as it is available for your channel
Restrict network exposure of the OpenShift console to trusted management networks using route policies or an ingress allowlist
Enforce container memory limits on the console pod to bound the impact of the DoS condition
Review console access logs for prior requests to /api/devfile/ and /api/devfile/samples/

Patch Information

Red Hat tracks remediation in Bugzilla #2517885. Consult the Red Hat CVE-2026-75885 Advisory for affected component versions, errata identifiers, and channel-specific update instructions.

Workarounds

Block external access to /api/devfile/ and /api/devfile/samples/ at an upstream reverse proxy or ingress controller until the patch is applied
Apply NetworkPolicy rules that restrict egress from the console pod to only the required devfile registry hosts
Deny egress from the console pod to the cloud metadata address 169.254.169.254 and to internal service CIDRs not required by the console

bash

# Example NetworkPolicy restricting console egress (adapt namespace and selectors to your environment)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: console-egress-restrict
  namespace: openshift-console
spec:
  podSelector:
    matchLabels:
      app: console
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16