CVE-2026-62284 osac-project CVE debrief

Who should care

Deployments using remote or auto VM cluster mode, specifically those with console-proxy and Secret read access, should assess exposure and apply patches immediately. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of their environments. Immediate action is required to prevent potential remote code execution and server-side request forgery attacks.

Why it matters

CVE-2026-62284 allows remote code execution and server-side request forgery in OSAC operator's console-proxy, requiring immediate patching for deployments using remote or auto VM cluster mode.

• Remote code execution inside the console-proxy pod
• Server-side request forgery from within the proxy pod
• Potential for lateral movement within the cluster
• Need for immediate patching and verification of kubeconfig Secrets

Technical summary

The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets without sanitizing the resulting rest.Config. This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: 'true' in a namespace where the console-proxy has Secret read access. The vulnerability also enables server-side request forgery from within the proxy pod via attacker-controlled clusters[].server. Affected configurations include any deployment using remote or auto VM cluster mode, which is the default. The fix involves modifying internal/consoleproxy/config_resolver.go.

Defensive priority

High priority for deployments using remote or auto VM cluster mode

Recommended defensive actions

• Review and apply patches immediately for deployments using remote or auto VM cluster mode
• Verify kubeconfig Secrets and RoleBindings for potential exposure
• Monitor console-proxy logs for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, affected configurations, and patches. However, the CVSS score and severity are not provided. The vulnerability is caused by the console-proxy's RemoteConfigResolver parsing kubeconfig data from Kubernetes Secrets without sanitizing the resulting rest.Config. This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: 'true' in a namespace where the The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.