CVE-2026-50237

HIGH

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVSS v3.1 Score

7.4
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Published: 8/11/2026Modified: 8/19/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-50237 — A Server-Side Request Forgery and supply chain flaw was found in the OpenShift C...

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

CVE-2026-50237
NIST NVD

References (5)

https://access.redhat.com/errata/RHSA-2026:54583https://access.redhat.com/errata/RHSA-2026:54602https://access.redhat.com/errata/RHSA-2026:54770https://access.redhat.com/security/cve/CVE-2026-50237https://bugzilla.redhat.com/show_bug.cgi?id=2484746