CVE-2026-75886: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat Red Hat OpenShift Container Platform 4
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
AI Analysis
Technical Summary
The vulnerability arises from a misconfiguration in the CatalogdHandler within the OpenShift console, which does not enforce authentication and forwards the openshift-session-token cookie. This allows an unauthenticated attacker to proxy requests to the in-cluster catalogd service, leading to disclosure of internal operator-catalog data and providing a relay into the openshift-catalogd namespace. The issue is classified as an unintended proxy or intermediary ('Confused Deputy') vulnerability. The CVSS v3.1 base score is 7.2 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and scope changed. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability.
Potential Impact
An unauthenticated network attacker can exploit this vulnerability to bypass access controls and disclose internal cluster information, specifically the operator-catalog index. This exposure could facilitate further attacks by revealing sensitive internal data and providing a relay into the openshift-catalogd namespace. The integrity and confidentiality impacts are low, and availability is not affected.
Mitigation Recommendations
Red Hat has stated that no mitigation is currently available that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Until a fix or mitigation is provided, caution is advised when exposing the OpenShift console to untrusted networks.
CVE-2026-75886: Unintended Proxy or Intermediary ('Confused Deputy') in Red Hat Red Hat OpenShift Container Platform 4
Description
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.
CVSS v3.1
Score 7.2high
Affected software
Red Hat
Red Hat OpenShift Container Platform 4
Red Hat
Red Hat OpenShift Container Platform 4
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from a misconfiguration in the CatalogdHandler within the OpenShift console, which does not enforce authentication and forwards the openshift-session-token cookie. This allows an unauthenticated attacker to proxy requests to the in-cluster catalogd service, leading to disclosure of internal operator-catalog data and providing a relay into the openshift-catalogd namespace. The issue is classified as an unintended proxy or intermediary ('Confused Deputy') vulnerability. The CVSS v3.1 base score is 7.2 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and scope changed. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, and stability.
Potential Impact
An unauthenticated network attacker can exploit this vulnerability to bypass access controls and disclose internal cluster information, specifically the operator-catalog index. This exposure could facilitate further attacks by revealing sensitive internal data and providing a relay into the openshift-catalogd namespace. The integrity and confidentiality impacts are low, and availability is not affected.
Mitigation Recommendations
Red Hat has stated that no mitigation is currently available that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Until a fix or mitigation is provided, caution is advised when exposing the OpenShift console to untrusted networks.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-18T13:44:59.078Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-75886","vendor":"Red Hat"}]
Threat ID: 6ab43e93f7a7c54106550f8a
Added to database: 09/23/2026, 21:03:15 UTC
Last enriched: 09/23/2026, 21:17:41 UTC
Last updated: 09/24/2026, 02:07:27 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.