CVE-2026-75886 is a security flaw in the OpenShift console's CatalogdHandler component. Due to a misconfiguration, the handler lacks proper authentication and forwards the openshift-session-token cookie to the in-cluster catalogd service. This allows an unauthenticated remote attacker to send requests to the catalogd service, leading to disclosure of the internal operator-catalog index and enabling a relay into the openshift-catalogd namespace. The vulnerability is classified under CWE-441 (Unintended Proxy or Intermediary) and has a CVSS v3.1 base score of 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and changed scope. The flaw compromises confidentiality and integrity but does not affect availability.

An unauthenticated network attacker can bypass access controls in the OpenShift console proxy configuration to access internal cluster information, specifically the operator-catalog index. This exposure could facilitate further attacks by providing insight into internal cluster components and potentially allowing relay access into the openshift-catalogd namespace. The impact is limited to confidentiality and integrity with no direct availability impact.

According to the Red Hat advisory, no effective mitigation is currently available that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates on fixes or mitigations. Until a fix is released, cautious use of the OpenShift console and limiting exposure of the console to untrusted networks is advisable. Engage with Red Hat support or Technical Account Managers for tailored guidance.