CVE-2026-75885

CriticalCVSS 9.3/10Last modified Oct 23, 2026

Description

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4.12	—
Red Hat	Red Hat OpenShift Container Platform 4.13	—
Red Hat	Red Hat OpenShift Container Platform 4.14	—
Red Hat	Red Hat OpenShift Container Platform 4.15	—
Red Hat	Red Hat OpenShift Container Platform 4.16	—
Red Hat	Red Hat OpenShift Container Platform 4.17	—
Red Hat	Red Hat OpenShift Container Platform 4.18	—
Red Hat	Red Hat OpenShift Container Platform 4.19	—
Red Hat	Red Hat OpenShift Container Platform 4.20	—
Red Hat	Red Hat OpenShift Container Platform 4.21	—
Red Hat	Red Hat OpenShift Container Platform 4.22	—

References

Timeline

Published: Sep 18, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-758867.2A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks CVE-2026-758877.5A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` CVE-2026-758887.7A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by p CVE-2026-758897.7Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched n CVE-2026-75895.3A vulnerability was determined in ghantakiran splunk-mcp-integration up to 0b86b09d5e5adf0433acd43c975951224613a1a6. Impacted is the functio CVE-2026-758918.8The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 vi CVE-2026-758926.5In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-fiel CVE-2026-758937.5In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame CVE-2026-758947.5In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU th CVE-2026-758957.5In libsmpp35 from 0.1.0 through 1.8.0 out of bound read issue was found in the at smpp34_unpack() function via attacker controlled SMPP PDUs CVE-2026-758969.1Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Defau CVE-2026-758977.5Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - migh