A critical flaw in the Red Hat OpenShift console exposes the /api/devfile/ endpoints without authentication, letting remote attackers coerce the console pod into internal requests and exhaust its memory.
What Is It
CVE-2026-75885 is a Server-Side Request Forgery vulnerability (CWE-918) in the Red Hat OpenShift console. The /api/devfile/ and /api/devfile/samples/ endpoints accept requests without authentication, so a remote attacker can submit crafted devfile payloads. Processing those payloads causes the console pod to issue requests to internal services and reflect partial responses back to the attacker.
The same endpoints carry a second defect: repeated large requests sent without a specified content length drive unbounded memory growth in the console pod, resulting in denial of service.
Red Hat scores the issue CVSS 3.1 9.3 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, network-reachable, low complexity, no privileges, no user interaction, with a changed scope reflecting that the impact lands on internal services beyond the console itself.
Why It Matters
The preconditions are minimal. An attacker needs only network reach to the console; there is no credential or interaction requirement. Because the console pod sits inside the cluster, SSRF through it turns an externally exposed web surface into a probe against internal services that were never meant to be reachable from outside, with partial response data returned to the attacker. High confidentiality impact and changed scope in the CVSS vector both reflect that pivot. The memory-growth path adds an availability hit against the console with the same lack of preconditions.
The supplied source material contains no evidence of active exploitation in the wild.
What's Vulnerable
Red Hat lists the following as affected (default status: affected):
- Red Hat OpenShift Container Platform 4: package
openshift4/ose-console(cpe:/a:redhat:openshift:4) - Red Hat OpenShift Container Platform 4: package
openshift4/ose-console-rhel9(cpe:/a:redhat:openshift:4)
Patch Status
The available source material carries no fix version, patch reference, or required-action guidance. Consult the Red Hat security advisory and Bugzilla entry below for current fix availability.
Sources
- Red Hat Security; CVE-2026-75885: https://access.redhat.com/security/cve/CVE-2026-75885
- Red Hat Bugzilla; Bug 2517885: https://bugzilla.redhat.com/show_bug.cgi?id=2517885