Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-75887— Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Quick assessment

Affected

Red Hat Red Hat OpenShift Container Platform 4

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenShift 控制台发现一个安全漏洞。未授权的攻击者可通过操纵端点中的和查询参数，利用路径遍历漏洞，读取 Pod 文件系统中敏感的文件，包括插件清单文件和配置文件。此外，该漏洞还可用于对已注册的动态插件后端进行路径遍历攻击。

CVSS 7.5 · High EPSS 0.36% · P28 Updated Sep 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`
Red Hat	Red Hat OpenShift Container Platform 4	-	`cpe:/a:redhat:openshift:4`

II. Public POCs for CVE-2026-75887

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-75887

请登录查看更多情报信息。

Other References for CVE-2026-75887 (2)

https://access.redhat.com/security/cve/CVE-2026-75887 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2517889 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-75887

Same Patch Batch · Red Hat · 2026-09-23 · 46 CVEs total

CVE-2026-84474	9.9 CRITICAL	Automation-controller: automation-controller-container: automation-controller: view_jobtem
CVE-2026-84502	9.9 CRITICAL	Automation-controller: automation-controller-container: automation-controller: project scm
CVE-2026-84719	9.9 CRITICAL	Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitiz
CVE-2026-75884	9.1 CRITICAL	Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in c
CVE-2026-96275	8.8 HIGH	Flatpak: flatpak: arbitrary write access as root via extra-data extraction
CVE-2026-84683	8.7 HIGH	Automation-controller: automation-controller-container: automation-controller: stored cros
CVE-2026-84691	8.7 HIGH	Automation-controller: automation-controller-container: automation-controller: format stri
CVE-2026-76648	8.5 HIGH	Automation-controller: automation-controller-container: aap controller: copyapiview.post()
CVE-2026-84486	8.2 HIGH	Automation-controller: automation-controller-container: automation-controller: unauthentic
CVE-2026-96512	7.8 HIGH	Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authori
CVE-2026-96889	7.8 HIGH	Librsvg: use-after-free when xml includes have duplicated entities
CVE-2026-84499	7.7 HIGH	Automation-controller: automation-controller-container: automation-controller: write-only
CVE-2026-84706	7.6 HIGH	Automation-controller: automation-controller-container: automation-controller: credential
CVE-2026-96541	7.5 HIGH	Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake d
CVE-2026-88830	7.5 HIGH	Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pr
CVE-2026-88832	7.3 HIGH	Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label
CVE-2026-85475	7.2 HIGH	Automation-controller: automation-controller-container: automation-controller: rsyslog con
CVE-2026-75886	7.2 HIGH	Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd
CVE-2026-84714	7.1 HIGH	Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jin
CVE-2026-96445	6.8 MEDIUM	Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against

Showing top 20 of 46 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Red Hat OpenShift Container Platform 4

Same vendor: Red Hat

Same weakness: CWE-22

V. Comments for CVE-2026-75887

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-75887— Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

Quick assessment

I. Basic Information for CVE-2026-75887

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-75887

III. Intelligence Information for CVE-2026-75887

Other References for CVE-2026-75887 (2)

Same Patch Batch · Red Hat · 2026-09-23 · 46 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-75887

Leave a comment