This vulnerability involves an SSRF flaw in the OpenShift Console Helm catalog proxy, allowing a namespace tenant to plant a ProjectHelmChartRepository resource with an arbitrary URL. The console pod fetches this URL server-side, bypassing tenant egress restrictions. When combined with catalog metadata poisoning and administrative chart installation, this enables privilege escalation within the platform. The flaw affects Red Hat OpenShift Container Platform 4. The CVSS v3.1 score is 7.4 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. The impact includes low confidentiality, integrity, and availability impacts. The vendor advisory recommends reviewing existing ProjectHelmChartRepository resources for unexpected URLs, applying NetworkPolicy egress restrictions to the openshift-console namespace, verifying chart provenance before installation, and restricting ProjectHelmChartRepository creation via RBAC if not required. No explicit patch or fix release is stated in the advisory at this time.

The vulnerability allows a namespace tenant to bypass egress restrictions by causing the console pod to fetch arbitrary URLs server-side. This can lead to privilege escalation through catalog metadata poisoning and admin-mediated chart installation. The impact is rated as low on confidentiality, integrity, and availability but the overall severity is high due to the potential for privilege escalation and scope change within the OpenShift platform.

Red Hat advises reviewing all ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs and applying NetworkPolicy egress restrictions to the openshift-console namespace, with allow-listing of required console egress targets. Administrators should verify the provenance of Helm charts before installation from namespace-scoped repositories. Additionally, restricting or disabling ProjectHelmChartRepository creation via RBAC for tenants that do not require custom Helm repositories is recommended. No official fix or patch is currently stated; patch status is not yet confirmed—check the Red Hat advisory for updates.