Threats tagged 'ghsa-f8rq-4f8p-cmww'

A vulnerability (CVE-2026-75886) was identified in the OpenShift Console component where a misconfiguration in the CatalogdHandler allows unauthenticated remote attackers to forward the openshift-session-token cookie improperly. This flaw enables attackers to send requests to the in-cluster catalogd service, potentially disclosing the internal operator-catalog index and providing a relay into the openshift-catalogd namespace. The issue has a CVSS 3.1 base score of 7.2, indicating high severity. Red Hat has released OpenShift Container Platform 4.20.40 with fixes addressing this and other issues. Users are advised to upgrade to this version to mitigate the vulnerability.