CVE-2026-75888: OpenShift Console SSRF Vulnerability

CVE-2026-75888 Overview

CVE-2026-75888 is a Server-Side Request Forgery (SSRF) vulnerability in the Red Hat OpenShift console. An authenticated console user can supply a specially crafted Helm chart URL that bypasses validation. The console pod then fetches the attacker-supplied URL on behalf of the user. This behavior allows blind port scanning inside the cluster and can expose sensitive information through error responses. The flaw is tracked as CWE-918: Server-Side Request Forgery and carries a network attack vector with changed scope, meaning the impact crosses the console's trust boundary into the cluster network.

Critical Impact
An authenticated attacker can coerce the OpenShift console pod to issue arbitrary HTTP requests, enabling internal reconnaissance and disclosure of cluster-internal services.

Affected Products

Red Hat OpenShift Container Platform console component
OpenShift console deployments that process Helm chart URLs from authenticated users
Red Hat Bug Report tracked under Bugzilla #2517888

Discovery Timeline

2026-10-12 - CVE-2026-75888 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-75888

Vulnerability Analysis

The OpenShift console accepts Helm chart URLs from authenticated users as part of its chart repository workflow. The console pod fetches these URLs server-side to retrieve chart metadata. The input validation layer does not sufficiently restrict the destination host, scheme, or network range of the supplied URL. An authenticated user can submit a URL pointing at cluster-internal addresses such as the Kubernetes API server, metadata services, or private service endpoints. The console pod then performs the request from inside the cluster network.

Responses, status codes, and error messages returned to the caller leak information about reachable hosts and ports. This supports blind port scanning across the cluster. Confidentiality impact is high while integrity and availability impacts are not affected, which aligns with a read-oriented SSRF primitive.

Root Cause

The root cause is missing or incomplete validation of user-controlled URLs before the console backend performs an outbound HTTP request. The code trusts the chart URL supplied by the authenticated user instead of enforcing an allowlist of chart repositories, blocking private IP ranges, or stripping metadata endpoints. This matches the classic CWE-918 pattern.

Attack Vector

An attacker first authenticates to the OpenShift console with any valid user account. The attacker then invokes the Helm chart loading workflow and provides a URL pointing to an internal target, such as http://169.254.169.254/, https://kubernetes.default.svc/, or an internal service address. The console pod resolves and fetches the URL. The attacker observes response latency, status codes, and error messages to map internal services and extract reachable content. The vulnerability requires authentication but no user interaction and is exploitable over the network.

No verified public exploit code is available at the time of writing. See the Red Hat CVE-2026-75888 Advisory for additional technical detail.

Detection Methods for CVE-2026-75888

Indicators of Compromise

Outbound HTTP requests from the OpenShift console pod to internal IP ranges, link-local addresses such as 169.254.169.254, or the Kubernetes API service that do not match normal Helm repository traffic.
Console audit log entries showing Helm chart URL submissions targeting non-public hostnames or raw IP addresses.
Repeated chart repository add or load operations from the same authenticated user with varying URLs, consistent with scanning behavior.

Detection Strategies

Alert on egress traffic from the console pod that resolves to RFC1918, loopback, link-local, or cluster-internal service CIDRs.
Correlate console API events for Helm chart operations with downstream DNS and HTTP egress from the console pod identity.
Baseline normal Helm repository hostnames per namespace and flag deviations.

Monitoring Recommendations

Enable and centralize OpenShift audit logs for the console component and ship them to a SIEM for correlation.
Monitor Kubernetes NetworkPolicy denials involving the console pod to catch blocked SSRF attempts.
Track error-rate spikes on the console backend tied to chart URL fetches, which often indicate scanning activity.

How to Mitigate CVE-2026-75888

Immediate Actions Required

Apply the fixed OpenShift console build as published in the Red Hat CVE-2026-75888 Advisory once available for your channel.
Restrict console access to trusted users and enforce strong authentication, since exploitation requires an authenticated session.
Review recent console audit logs for Helm chart URLs targeting internal addresses and investigate any matches.

Patch Information

Red Hat tracks remediation under Bugzilla #2517888 and the Red Hat CVE-2026-75888 Advisory. Consult the advisory for the specific OpenShift Container Platform versions and errata that contain the fix, and apply updates through your standard OpenShift update channel.

Workarounds

Apply a Kubernetes NetworkPolicy on the openshift-console namespace to deny egress to cluster-internal CIDRs, the API server, and the cloud instance metadata endpoint.
Constrain Helm chart repositories to an administrator-approved allowlist and block ad-hoc user-supplied URLs where feasible.
Limit console access to users who require it and remove unneeded role bindings that grant chart repository management.

bash

# Example NetworkPolicy restricting console pod egress to internal ranges
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: console-restrict-egress
  namespace: openshift-console
spec:
  podSelector:
    matchLabels:
      app: console
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/16
        - 169.254.0.0/16
        - 127.0.0.0/8