A flaw was found in the OpenShift console. (CVE-2026-75888)

The OpenShift console contains an SSRF vulnerability (CVE-2026-75888) that allows an authenticated console user to provide a specially crafted Helm chart URL. Due to insufficient validation, the console pod fetches arbitrary URLs specified by the user. This can lead to information disclosure through error messages or blind port scanning within the cluster environment. The vulnerability requires authentication and has a CVSS 3.1 base score of 7.7, indicating high severity. No vendor advisory or patch details are currently available.

An authenticated user can exploit this SSRF vulnerability to cause the OpenShift console pod to make arbitrary network requests. This may disclose sensitive information through error messages and enable reconnaissance activities such as blind port scanning inside the cluster. There is no indication of direct integrity or availability impact. No known active exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict console user permissions to trusted users only and monitor for suspicious activity related to Helm chart URL usage. Avoid exposing the console to untrusted networks.