OpenShift console: authenticated user makes the console pod fetch arbitrary URLs via a Helm chart URL (SSRF)

Impact

Any authenticated console user can supply a crafted Helm chart URL that the console pod fetches without validation. The console runs inside the cluster with network reach that ordinary users do not have, so this turns a low-privilege account into a probe on the cluster's internal network: blind port scanning of in-cluster services, and disclosure of response content through error messages. On a shared GPU cluster that means a tenant with nothing but console login can map the control plane, metrics, scheduler and storage endpoints sitting on the pod network, and pull data back from any of them that answers unauthenticated. Red Hat scores it with a scope change and high confidentiality impact; there is no integrity or availability impact.

Who can reach it

Network, authenticated with low privilege: anyone who can log in to the OpenShift web console. No cluster-admin rights and no pod on the cluster are needed.

What to do

Update to the OpenShift Container Platform 4 z-stream that carries the console fix; Red Hat tracks the affected and fixed releases on its CVE page for this id. The fix lands in the console operator and rolls the console pods, so it is a daemon restart rather than a node drain - no reboot and no workload disruption on GPU nodes. Where the patch cannot be scheduled yet, reduce exposure by limiting who holds console access and by egress-restricting the console namespace with a NetworkPolicy.

References

Related entries

• RHACS Central: unbounded GraphQL query depth lets an authenticated user stall the management planeCVE-2026-9165 · Red Hat Advanced Cluster Security for Kubernetes (Central GraphQL API, query depth limit)High
• KubeVirt: Symlink path traversal in the virt-exportserver VMExport directory endpointCVE-2026-9804 · KubeVirtHigh
• ingress-nginx: Custom nginx snippets in an Ingress annotation retrieve the ingress-nginx service-account tokenCVE-2021-25742 · ingress-nginxHigh
• ingress-nginx: Ingress `path` can be pointed at the service-account token fileCVE-2021-25745 · ingress-nginxHigh
• ingress-nginx: Directive injection through Ingress annotations obtains controller credentialsCVE-2021-25746 · ingress-nginxHigh
• ingress-nginx: Newline character bypasses `path` sanitizationCVE-2021-25748 · ingress-nginxHigh