Red Hat Security Advisory: OpenShift Container Platform 4.18.53 bug fix and security update

CVE-2026-50236 is an authenticated SSRF vulnerability in the OpenShift Console Dev Console webhook helpers of Red Hat OpenShift Container Platform 4.18.53. The vulnerability allows attackers with authenticated access to supply target URLs that the console pod fetches without validation, including path neutralization that enables arbitrary endpoint targeting and full response reflection. This occurs because the console pod has privileged network access, which can be abused to reach internal or restricted endpoints. Red Hat has released updated container images and RPM packages in OpenShift Container Platform 4.18.53 to address this issue. The advisory recommends applying NetworkPolicy egress restrictions to the openshift-console namespace to restrict outbound traffic to only necessary endpoints such as the Kubernetes API server, OAuth server, and monitoring services. Monitoring console access logs for unusual POST requests to webhook paths is also advised. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery) and has a Red Hat CVSS v3 score of 7.4 (Important).

The vulnerability allows an authenticated user to perform SSRF attacks from the console pod, which has privileged network access. This can lead to unauthorized access to internal endpoints, bypassing network access controls such as firewalls. The attacker can cause the console pod to fetch arbitrary URLs and reflect full responses, potentially exposing sensitive data or enabling further attacks within the internal network. The impact is rated as low confidentiality, integrity, and availability impact but the scope is changed due to the privileged network position of the console pod.

Red Hat has released OpenShift Container Platform 4.18.53 which includes fixes for this vulnerability. Users should upgrade to this version using the official upgrade instructions provided by Red Hat. Additionally, apply NetworkPolicy egress restrictions to the openshift-console namespace to limit outbound connectivity of the console pod to only required endpoints such as the Kubernetes API server, OAuth server, and monitoring services. Avoid blanket default-deny egress policies as they may break console functionality. Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values pointing to internal addresses or containing query separators. Follow Red Hat's official advisories and documentation for detailed guidance.