CVE-2026-75886: OpenShift Console Auth Bypass Vulnerability

CVE-2026-75886 Overview

A flaw in the OpenShift Console CatalogdHandler allows unauthenticated remote attackers to reach the in-cluster catalogd service. The handler lacks proper authentication and forwards the openshift-session-token cookie without validation. Attackers can query the internal operator-catalog index and pivot into the openshift-catalogd namespace. Red Hat tracks the issue under Red Hat CVE-2026-75886 Advisory and Red Hat Bug Report #2517886. The weakness is classified as [CWE-441] Unintended Proxy or Intermediary (Confused Deputy).

Critical Impact
Unauthenticated network attackers can disclose internal operator-catalog data and relay requests into the openshift-catalogd namespace of an OpenShift cluster.

Affected Products

Red Hat OpenShift Container Platform (openshift/console component)
OpenShift Console CatalogdHandler
In-cluster catalogd service in the openshift-catalogd namespace

Discovery Timeline

2026-09-23 - CVE CVE-2026-75886 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75886

Vulnerability Analysis

The OpenShift Console exposes a CatalogdHandler that proxies requests to the cluster-internal catalogd service. The handler does not enforce authentication on incoming requests before forwarding them. It additionally forwards the openshift-session-token cookie to the backend service. An unauthenticated remote attacker can craft HTTP requests that traverse the console into a privileged internal service. The result is disclosure of the operator-catalog index and a relay foothold inside the openshift-catalogd namespace. The confused-deputy pattern here matches [CWE-441], where a trusted intermediary acts on behalf of an untrusted caller.

Root Cause

The root cause is missing authentication on the CatalogdHandler proxy endpoint combined with unconditional forwarding of the session-token cookie. The console component trusts the transport path instead of verifying the caller identity before brokering requests to catalogd.

Attack Vector

Exploitation requires network reachability to the OpenShift Console endpoint. No credentials, user interaction, or prior privileges are required. An attacker issues HTTP requests to the vulnerable handler route and receives responses from the internal catalogd service. Refer to the Red Hat CVE-2026-75886 Advisory for handler paths and version specifics.

No verified proof-of-concept code is published. The vulnerability mechanism is described in prose per the referenced Red Hat advisories.

Detection Methods for CVE-2026-75886

Indicators of Compromise

Unauthenticated HTTP requests to OpenShift Console routes that proxy to the catalogd service.
Console access logs showing responses from CatalogdHandler without a preceding authenticated session.
Unexpected outbound traffic from the console pod to services in the openshift-catalogd namespace originating from external client IPs.

Detection Strategies

Correlate console pod access logs with API server audit logs to identify catalogd requests lacking a valid user identity.
Alert on HTTP 200 responses from CatalogdHandler routes where the request did not carry a validated openshift-session-token.
Baseline normal callers of the operator-catalog index and flag anomalous source IPs or user agents.

Monitoring Recommendations

Enable and centralize OpenShift API server and console component audit logs.
Monitor NetworkPolicy events and denied connections targeting the openshift-catalogd namespace.
Track ingress traffic volumes to console routes for spikes consistent with enumeration of catalog contents.

How to Mitigate CVE-2026-75886

Immediate Actions Required

Restrict external network exposure of the OpenShift Console until a patched build is deployed.
Apply the vendor-supplied update referenced in the Red Hat CVE-2026-75886 Advisory as soon as it is available for your channel.
Rotate any session tokens or service credentials that may have been exposed through the console proxy path.

Patch Information

Consult the Red Hat CVE-2026-75886 Advisory and Red Hat Bug Report #2517886 for fixed component versions and rollout guidance for affected OpenShift Container Platform releases.

Workarounds

Place the OpenShift Console behind an authenticating reverse proxy or restrict access with an ingress allow-list until patched.
Apply Kubernetes NetworkPolicy rules that limit which workloads can reach the catalogd service in the openshift-catalogd namespace.
Disable or block the CatalogdHandler route at the ingress layer if it is not required for operational workflows.

bash

# Example NetworkPolicy limiting ingress to catalogd
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-catalogd-ingress
  namespace: openshift-catalogd
spec:
  podSelector:
    matchLabels:
      app: catalogd
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: openshift-operator-lifecycle-manager