VDB

CVE-2026-75885

CVE-2026-75885 PUBLISHED CVSS 9.3 CRITICAL

Reported by redhat · Published September 18, 2026

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

Risk Scores

CVSS 3.1
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.121790102793
Red HatRed Hat OpenShift Container Platform 4.171789939565
Red HatRed Hat OpenShift Container Platform 4.181789904865
Red HatRed Hat OpenShift Container Platform 4.191790095950
Red HatRed Hat OpenShift Container Platform 4.201790112153
Red HatRed Hat OpenShift Container Platform 4.211790142788
Red HatRed Hat OpenShift Container Platform 4.221790130905
Red HatRed Hat OpenShift Container Platform 4.221790130905, 1790130905, 1790130905
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.171789939565
Red HatRed Hat OpenShift Container Platform 4.121790102793
Red HatRed Hat OpenShift Container Platform 4.211790142788, 1790142788, 1790142788
Red HatRed Hat OpenShift Container Platform 4
Red HatRed Hat OpenShift Container Platform 4.201790112153, 1790112153, 1790112153
Red HatRed Hat OpenShift Container Platform 4.191790095950, 1790095950
Red HatRed Hat OpenShift Container Platform 4.181789904865

Timeline

  • Sep 18, 2026 CVE Published
  • Sep 19, 2026 EPSS Score
  • Sep 19, 2026 Coalition ESS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score
  • Oct 1, 2026 EPSS Score
  • Oct 2, 2026 EPSS Score
  • Oct 2, 2026 Distribution Patch
  • Oct 2, 2026 Distribution Patch
  • Oct 2, 2026 Distribution Patch
  • Oct 2, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›