NVD HIGH: CVE-2026-50237 — A Server-Side Request Forgery and supply chain flaw was found in the OpenShift C...

Tuesday, August 11, 2026 at 12:17 PM UTC·Source: NIST NVD

Updated: Tuesday, August 11, 2026 at 04:00 PM UTC

Executive Summary

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-50237

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Aug 11, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

CVE-2026-6837: Command Injection in Zyxel export-cgi PKCS#12 Export Handling

[object Object]

CVE-2026-6837

3h agor/netsec

CRITICALVulnerability

NVD CRITICAL: CVE-2026-74790 — Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering...

Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants.

CVE-2026-74790

7h agoNIST NVD

CRITICALVulnerability

NVD CRITICAL: CVE-2026-73061 — Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedOb...

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

CVE-2026-73061

7h agoNIST NVD