Cloud & container securityHigh severity

SECURITY GUIDE

Server-Side Request Forgery in Red Hat OpenShift Console (CVE-2026-75888)

Analyze how unvalidated Helm repository URLs in container web consoles permit authenticated internal network reconnaissance.

Areas to considerRed Hat OpenShift ConsoleKubernetes clustersCluster management networks
01

THE CONTEXT

What to understand

CVE-2026-75888 is a Server-Side Request Forgery (SSRF) flaw in the Red Hat OpenShift web console. In affected versions, authenticated users can specify custom Helm chart repository URLs during application catalog browsing. The backend console service fetches index metadata from the user-provided URL without validating that the target address is external, allowing requests to target loopback services, cluster node management ports, and cloud provider metadata APIs.

02

HIGH-LEVEL CONCEPT

How the risk can develop

This is a conceptual overview, not a procedure for reproducing an attack.

  1. An authenticated OpenShift console user adds a custom Helm repository with a target URL pointing to an internal address.
  2. The console backend server performs an HTTP request to index the repository without applying egress IP filtering.
  3. The internal service or metadata API responds to the console server, returning sensitive operational data.
  4. The response details or metadata error messages are displayed back to the user within the console UI.
03

WHY IT MATTERS

Potential impact

Scanning of internal cluster networks, access to private container control planes, extraction of cloud provider node credentials, and discovery of unexposed internal services.

04

BE AWARE

Signals to monitor

  • Audit logs showing Helm repository additions containing private CIDR (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
  • OpenShift console pods initiating anomalous outbound network requests to internal Kubernetes API ports or cloud metadata IPs.
  • WAF and egress network policy alert logs indicating unexpected internal IP destination queries.
05

PUT DEFENSE FIRST

Recommended defenses

  1. 01Apply Red Hat OpenShift Container Platform errata patches addressing CVE-2026-75888.
  2. 02Implement Kubernetes NetworkPolicies restricting console pods from reaching internal cluster infrastructure or cloud metadata IPs.
  3. 03Enforce egress proxy rules with strict destination address allowlists for cluster-initiated outbound HTTP requests.
  4. 04Configure IMDSv2 with hop-limit 1 on cloud instances hosting cluster worker nodes.