CVE-2026-75887 Overview
CVE-2026-75887 is a path traversal vulnerability in the OpenShift console. An unauthenticated attacker can manipulate the lng and ns query parameters on the /locales/resource.json endpoint to read sensitive *.json files from the pod filesystem. Exposed files include plugin manifests and configuration data. The flaw also enables path traversal against registered dynamic-plugin backends, extending the read surface beyond the console pod itself. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Unauthenticated remote attackers can retrieve arbitrary *.json files from the OpenShift console pod and pivot into dynamic-plugin backends, exposing configuration and manifest data.
Affected Products
- Red Hat OpenShift Console (see Red Hat CVE-2026-75887 Advisory for affected version ranges)
- OpenShift dynamic-plugin backends registered with the console
- Downstream distributions bundling the vulnerable console component
Discovery Timeline
- 2026-09-23 - CVE CVE-2026-75887 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-75887
Vulnerability Analysis
The OpenShift console exposes a translation resource endpoint at /locales/resource.json. The endpoint accepts two user-controlled query parameters: lng (language) and ns (namespace). The console uses these values to construct a filesystem path when loading translation JSON files.
Because input is not properly constrained to the intended locales directory, an attacker can inject path traversal sequences into either parameter. The server resolves the manipulated path and returns file contents when the target is a *.json file. No authentication is required to reach the endpoint.
Beyond reading files inside the console pod, the same parameter handling is reused when the console proxies requests to registered dynamic-plugin backends. This allows an attacker to traverse paths on plugin services as well, broadening data exposure across the cluster.
Root Cause
The root cause is improper input validation on the lng and ns parameters. The console concatenates or joins these values into a filesystem path without normalizing the result or verifying that it remains within the intended locales base directory. Traversal sequences such as ../ are not stripped or rejected before path resolution.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP GET request to /locales/resource.json with traversal payloads in the lng or ns parameters. The server responds with the contents of the targeted JSON file, including plugin manifests, service configuration, and other console-accessible resources.
The vulnerability is described in the Red Hat Bug Report #2517889. No verified public exploit code is available at the time of publication.
Detection Methods for CVE-2026-75887
Indicators of Compromise
- HTTP requests to /locales/resource.json containing ../, ..%2f, or encoded traversal sequences in the lng or ns query parameters.
- Console access logs showing responses returning non-locale JSON files such as plugin manifests or service configuration.
- Anomalous request volume to the locales endpoint from a single unauthenticated source IP.
- Downstream requests from the console to dynamic-plugin backends containing traversal patterns.
Detection Strategies
- Inspect OpenShift console ingress and route logs for query strings on /locales/resource.json that contain path traversal tokens or URL-encoded equivalents.
- Correlate console pod filesystem reads with unauthenticated HTTP requests to identify access to non-translation files.
- Deploy Web Application Firewall (WAF) rules that block traversal sequences in query parameters targeting the console.
Monitoring Recommendations
- Forward console access logs and audit events to a centralized SIEM for continuous query-parameter analysis.
- Alert on any successful response from /locales/resource.json where the resolved file path falls outside the console locales directory.
- Monitor dynamic-plugin backend logs for unusual request paths originating from the console proxy.
How to Mitigate CVE-2026-75887
Immediate Actions Required
- Apply the patched OpenShift console version identified in the Red Hat CVE-2026-75887 Advisory.
- Restrict network exposure of the OpenShift console to trusted management networks until patching is complete.
- Audit console and dynamic-plugin pods for evidence of prior traversal requests and rotate any credentials exposed through readable JSON files.
Patch Information
Red Hat tracks remediation under Red Hat Bug #2517889. Consult the Red Hat CVE-2026-75887 Advisory for the fixed console versions and errata applicable to each supported OpenShift release. Apply the vendor-supplied errata through the standard cluster upgrade process.
Workarounds
- Block or rewrite requests to /locales/resource.json at an upstream reverse proxy or ingress controller when the lng or ns parameters contain . sequences or non-alphanumeric characters.
- Limit console reachability to authenticated administrators via network policy or VPN until the patch is deployed.
- Disable or de-register non-essential dynamic plugins to reduce the traversal surface against plugin backends.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.