VDB

CVE-2026-50237

CVE-2026-50237 PUBLISHED CVSS 7.4 HIGH

Reported by redhat · Published August 11, 2026

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Risk Scores

CVSS 3.1
7.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.121786511587
Red HatRed Hat OpenShift Container Platform 4.131786477760
Red HatRed Hat OpenShift Container Platform 4.141787056403
Red HatRed Hat OpenShift Container Platform 4.151787028559
Red HatRed Hat OpenShift Container Platform 4.161787054159
Red HatRed Hat OpenShift Container Platform 4.181786540776
Red HatRed Hat OpenShift Container Platform 4.191786486822
Red HatRed Hat OpenShift Container Platform 4.201786534931
Red HatRed Hat OpenShift Container Platform 4.211786574043
Red HatRed Hat OpenShift Container Platform 4.221786607915
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.221786607915, 1786607915, 1786607915
Red HatRed Hat OpenShift Container Platform 4.131786477760, 1786477760, 1786477760
Red HatRed Hat OpenShift Container Platform 4.121786511587, 1786511587, 1786511587
Red HatRed Hat OpenShift Container Platform 4.161787054159
Red HatRed Hat OpenShift Container Platform 4.201786534931, 1786534931, 1786534931
Red HatRed Hat OpenShift Container Platform 4.141787056403
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.181786540776, 1786540776, 1786540776
Red HatRed Hat OpenShift Container Platform 4.191786486822, 1786486822, 1786486822

…and 3 more

Timeline

  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 27, 2026 EPSS Score
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Distribution Patch
  • Aug 27, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›