Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-75885: OpenShift Console allows unauthenticated SSRF and memory overload
CVE-2026-75885 · published 23 days ago
Summary
The OpenShift Container Platform 4 console lets anyone reach the /api/devfile/ endpoints without logging in. An attacker can trick the console into contacting internal services and can also flood it with large requests, causing the server to run out of memory and stop responding. Apply the latest security update from Red Hat and restrict access to these endpoints.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat openshift container platform 4 | All versions |
| red hat | red hat openshift container platform 4.20 | All versions |
| red hat | red hat openshift container platform 4.21 | All versions |
| red hat | red hat openshift container platform 4.22 | All versions |
| red hat | red hat openshift container platform 4.12 | All versions |
| red hat | red hat openshift container platform 4.17 | All versions |
| red hat | red hat openshift container platform 4.18 | All versions |
| red hat | red hat openshift container platform 4.19 | All versions |
| red hat | red hat openshift container platform 4.14 | All versions |
| red hat | red hat openshift container platform 4.16 | All versions |
Original advisory text
Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
References
- https://access.redhat.com/errata/RHSA-2026:73853 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:73869 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-75885 vdb-entry x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2517885 issue-tracking x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71450 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71453 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71454 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:70587 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:70617 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:70647 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71447 vendor-advisory x_refsource_REDHAT
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published18 Sep 2026
Updated10 Oct 2026
First seen18 Sep 2026
Track software like this
Free during beta