CVE-2026-75888 Red Hat CVE debrief

Who should care

Defenders responsible for OpenShift Container Platform 4 deployments, particularly those with console access exposed to authenticated users, should assess exposure and prioritize patching and additional security measures.

Why it matters

CVE-2026-75888 is an authenticated SSRF vulnerability in OpenShift console that allows for potential sensitive information disclosure and blind port scanning. Defenders should prioritize verifying and patching affected deployments, restricting console access, and monitoring logs.

• Potential sensitive information disclosure through error messages
• Blind port scanning within the cluster
• Verification of affected versions and patch application
• Monitoring console logs for suspicious activity

Technical summary

The OpenShift console is vulnerable to an authenticated Server-Side Request Forgery (SSRF) attack. An authenticated console user can provide a specially crafted Helm chart URL to make the console pod fetch arbitrary URLs, potentially leading to sensitive information disclosure through error messages or enabling blind port scanning within the cluster. The vulnerability allows for potential sensitive information disclosure and blind port scanning. Defenders should prioritize verifying and patching affected OpenShift Container Platform 4 deployments, particularly those with console access exposed to authenticated users, and restrict console access to authenticated users.

Defensive priority

Defenders should prioritize verifying and patching affected OpenShift Container Platform 4 deployments, particularly those with console access exposed to authenticated users.

Recommended defensive actions

• Verify and apply patches for OpenShift Container Platform 4
• Restrict console access to authenticated users
• Monitor console logs for suspicious activity
• Implement additional security measures to prevent SSRF attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the SSRF vulnerability in OpenShift console, including the potential for sensitive information disclosure and blind port scanning. The OpenShift console is vulnerable to an authenticated Server-Side Request Forgery (SSRF) attack. An authenticated console user can provide a specially crafted Helm chart URL to make the console pod fetch arbitrary URLs, potentially leading to sensitive information disclosure through error messages or enabling blind port scanning within the cluster. Def

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.