Security Advisory

CVE-2026-50237

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-11 11:23:55

Last updated 2026-08-23 10:28:22

Assigner redhat

CVSS score 7.4

State PUBLISHED

Description

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

← Browse all CVEs View on cve.org ↗