CVE-2026-50236
CVSS 7.4 · YüksekNVD: Awaiting Analysis
Açıklama (NVD)
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Yayın: 11.08.2026 · Son değişiklik: 24.10.2026 · Zayıflık: CWE-918
CVSS 3.1 metrikleri
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
| Saldırı vektörü | Ağ (uzaktan) |
| Karmaşıklık | Düşük |
| Gereken yetki | Düşük |
| Kullanıcı etkileşimi | Gerekmez |
| Kapsam | Değişir |
| Gizlilik | Düşük |
| Bütünlük | Düşük |
| Erişilebilirlik | Düşük |
Hesaplanan temel puan: 7.4. CVSS hesaplayıcıda incele
Referanslar
- https://access.redhat.com/errata/RHSA-2026:54545
- https://access.redhat.com/errata/RHSA-2026:54555
- https://access.redhat.com/errata/RHSA-2026:54583
- https://access.redhat.com/errata/RHSA-2026:54602
- https://access.redhat.com/errata/RHSA-2026:54770
- https://access.redhat.com/errata/RHSA-2026:56789
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/security/cve/CVE-2026-50236
- https://bugzilla.redhat.com/show_bug.cgi?id=2484745