CVE-2026-50236 is an authenticated SSRF vulnerability in the OpenShift Console Dev Console webhook helpers of Red Hat OpenShift Container Platform 4.18.53. The vulnerability arises because user-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod. This allows an attacker with authenticated access to cause the console pod to make requests to arbitrary internal or external endpoints, potentially bypassing network access controls. Red Hat has released updated container images in OpenShift Container Platform 4.18.53 to address this issue. Mitigation includes applying NetworkPolicy egress restrictions to the openshift-console namespace to restrict outbound connectivity to only required endpoints such as the Kubernetes API server, OAuth server, and monitoring services. Monitoring console access logs for unusual POST requests to the webhook API paths is also recommended. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).

This vulnerability allows an authenticated user to cause the OpenShift console pod to make arbitrary HTTP requests to internal or external endpoints without validation, potentially bypassing network access controls such as firewalls. The attacker can receive full response reflection from these requests, which may lead to information disclosure or facilitate further attacks within the privileged network context of the console pod. The impact is rated as important by Red Hat with a CVSS v3 base score of 7.4, indicating a high-severity issue with low attack complexity and low privileges required.

Red Hat has released OpenShift Container Platform 4.18.53 containing fixes for this vulnerability. Users should upgrade to this version as soon as it is available in their release channel. Additionally, apply NetworkPolicy egress restrictions to the openshift-console namespace to limit the console pod's outbound connectivity to only required endpoints such as the Kubernetes API server, OAuth server, and monitoring services. Note that a blanket default-deny egress policy will break console functionality. Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values pointing to internal addresses or containing query separators. Follow the official Red Hat documentation for upgrading clusters and applying these mitigations.