CVE-2026-50237

HighCVSS 7.4/10Last modified Oct 24, 2026

Description

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat OpenShift Container Platform 4.18—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.22—

References

Timeline

Published
Aug 11, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-50248.8A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing CVE-2026-502408.8A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permissioCVE-2026-502429.8In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via diCVE-2026-502433.7In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator togethCVE-2026-502445.3The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-suppliedCVE-2026-502457.7Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve CVE-2026-502486.5In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAACVE-2026-502495.6Out-of-bounds read in the GenerationSetup for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allowCVE-2026-50256.5The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoCVE-2026-502515.3In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), gCVE-2026-502529.3In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increaseCVE-2026-502547.5An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default s
CVE-2026-50237: High severity, CVSS 7.4 | Vulnix