CVE-2026-75886— Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding
Quick assessment
Affected
Red Hat Red Hat OpenShift Container Platform 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 openshift/console 中发现了一个漏洞。未经验证的远程攻击者可以利用 CatalogdHandler 中的配置错误，该组件缺乏适当的身份验证，并转发 cookie。这使得攻击者能够向集群内的 catalogd 服务发送请求，导致内部 operator-catalog 索引泄露，并为进入 openshift-catalogd 命名空间提供了中继途径。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75886
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-75886
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75886
请登录查看更多情报信息。
Other References for CVE-2026-75886 (2)
Same Patch Batch · Red Hat · 2026-09-23 · 46 CVEs total
| CVE-2026-84474 | 9.9 CRITICAL | Automation-controller: automation-controller-container: automation-controller: view_jobtem |
| CVE-2026-84502 | 9.9 CRITICAL | Automation-controller: automation-controller-container: automation-controller: project scm |
| CVE-2026-84719 | 9.9 CRITICAL | Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitiz |
| CVE-2026-75884 | 9.1 CRITICAL | Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in c |
| CVE-2026-96275 | 8.8 HIGH | Flatpak: flatpak: arbitrary write access as root via extra-data extraction |
| CVE-2026-84691 | 8.7 HIGH | Automation-controller: automation-controller-container: automation-controller: format stri |
| CVE-2026-84683 | 8.7 HIGH | Automation-controller: automation-controller-container: automation-controller: stored cros |
| CVE-2026-76648 | 8.5 HIGH | Automation-controller: automation-controller-container: aap controller: copyapiview.post() |
| CVE-2026-84486 | 8.2 HIGH | Automation-controller: automation-controller-container: automation-controller: unauthentic |
| CVE-2026-96512 | 7.8 HIGH | Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authori |
| CVE-2026-96889 | 7.8 HIGH | Librsvg: use-after-free when xml includes have duplicated entities |
| CVE-2026-84499 | 7.7 HIGH | Automation-controller: automation-controller-container: automation-controller: write-only |
| CVE-2026-84706 | 7.6 HIGH | Automation-controller: automation-controller-container: automation-controller: credential |
| CVE-2026-96541 | 7.5 HIGH | Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake d |
| CVE-2026-75887 | 7.5 HIGH | Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handle |
| CVE-2026-88830 | 7.5 HIGH | Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pr |
| CVE-2026-88832 | 7.3 HIGH | Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label |
| CVE-2026-85475 | 7.2 HIGH | Automation-controller: automation-controller-container: automation-controller: rsyslog con |
| CVE-2026-84714 | 7.1 HIGH | Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jin |
| CVE-2026-96445 | 6.8 MEDIUM | Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Red Hat OpenShift Container Platform 4
-
CVE-2026-75887
Openshift/console: openshift/console: unauthenticated path t -
CVE-2026-75939
Openshift/oc-mirror: release signature verification: openpgp -
CVE-2026-15801
Cri-o: cri-o: insufficient validation during container check -
CVE-2026-75885
Openshift/console: openshift/console: unauthenticated ssrf a -
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-ti
Same vendor: Red Hat
-
CVE-2026-101333
Keycloak-services: keycloak-services: unbounded metric serie -
CVE-2026-101292
Artemis-core-client: unsafe reflection in apache activemq ar -
CVE-2026-86330
Noobaa-core: noobaa-core: os command injection in cluster_in -
CVE-2026-96284
Flatpak: flatpak: arbitrary read-access to files in the syst -
CVE-2026-96282
Flatpak: flatpak: extension metadata path traversal file exi
Same weakness: CWE-441
-
CVE-2026-72668
Unintended Proxy or Intermediary ('Confused Deputy') in Kiba -
CVE-2026-100706
kyverno before 1.19.1 Privilege Escalation via Policy apiCal -
CVE-2026-100625
Capgo Build Upload Proxy Authorization Bypass via TUS Resour -
CVE-2026-69399
Azure Arc Elevation of Privilege Vulnerability -
CVE-2026-50022
Metacat acts as unintended proxy to backend Apache SOLR engi
V. Comments for CVE-2026-75886
No comments yet