CVE-2026-75888: Server-Side Request Forgery (SSRF) in Red Hat Red Hat OpenShift Container Platform 4

This vulnerability exists in the OpenShift console component of Red Hat OpenShift Container Platform 4. It allows an authenticated user to perform SSRF by submitting a crafted Helm chart URL that is not properly validated. Exploitation results in the console pod fetching arbitrary URLs, which may disclose sensitive information via error messages or facilitate blind port scanning inside the cluster environment. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact without integrity or availability impact. The vendor advisory is available but does not explicitly state patch or remediation status in the provided data.

Successful exploitation can lead to disclosure of sensitive information through error messages and enable blind port scanning within the cluster, which could aid attackers in further reconnaissance or attacks. The confidentiality impact is high, while integrity and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-75888 for current remediation guidance. Since the vulnerability requires authenticated access, restricting console user privileges and monitoring for unusual Helm chart URL usage may help reduce risk until a fix is applied.