An authenticated SSRF vulnerability exists in the OpenShift Console Dev Console webhook helpers of Red Hat OpenShift Container Platform 4. The vulnerability arises because user-supplied target URLs are fetched server-side without validation, and path neutralization enables arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. This allows an attacker with low privileges to make the server send requests to arbitrary internal or external endpoints, potentially bypassing access controls such as firewalls. The vulnerability has a CVSS 3.1 base score of 7.4 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and scope changed. The impacts include low confidentiality, integrity, and availability impacts. Red Hat's advisory recommends applying NetworkPolicy egress restrictions to the openshift-console namespace to limit outbound connectivity to only required endpoints and monitoring for unusual POST requests to the webhook API paths. No official patch or remediation level has been published yet, and users should check the vendor advisory for updates.

The vulnerability allows an authenticated attacker with low privileges to cause the OpenShift console pod to make arbitrary HTTP requests to internal or external endpoints without validation. This can lead to information disclosure (confidentiality impact), unauthorized command execution or code injection (integrity impact), and potential service disruption (availability impact). The SSRF can bypass network access controls by leveraging the console pod's privileged network position. The overall impact is rated as high severity with low confidentiality, integrity, and availability impacts.

Red Hat recommends applying NetworkPolicy egress restrictions to the openshift-console namespace to restrict the console pod's outbound network connectivity to only required endpoints such as the Kubernetes API server, OAuth server, and monitoring services. A blanket default-deny egress policy is not advised as it will break console functionality. Additionally, monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths containing non-standard hostName values that point to internal addresses or contain query separators. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-50236 for current remediation guidance.