CVE-2026-75885
A flaw was found in the OpenShift console.
Published Sep 18, 2026 · updated Oct 15, 2026
A flaw was found in the OpenShift console. Unauthenticated access to the and endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 18, 2026 · NIST NVD
Detected
A flaw was found in the OpenShift console. Unauthenticated access to the and endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacke
Oct 15, 2026 · NIST NVD
Updated
A flaw was found in the OpenShift console. Unauthenticated access to the and endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacke
Sources
- CVE.orgVulnerability recordCVE-2026-75885
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-75885
A flaw was found in the OpenShift console. Unauthenticated access to the and endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to i
nvd.nist.gov