CVE-2026-75885 in OpenShift
Summary
by MITRE • 09/19/2026
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Red Hat OpenShift Console represents a critical security deficiency involving improper access control and input validation within the web-based management interface. Specifically, the flaw resides in two API endpoints: `/api/devfile/` and `/api/devfile/samples/`. These endpoints are designed to handle devfiles, which are YAML-based configuration files used by tools like OpenShift Dev Spaces to define development environments. The core issue is that these specific endpoints do not enforce authentication requirements for incoming requests. This misconfiguration allows any remote actor with network connectivity to the console service to interact directly with the backend logic without providing valid credentials or session tokens, effectively bypassing the intended security perimeter of the application layer.
The primary technical impact of this unauthenticated access is the potential for Server-Side Request Forgery (SSRF). When an attacker submits a crafted devfile payload through these endpoints, the OpenShift console pod processes the request and subsequently initiates HTTP requests to internal services based on the content or references within that payload. Because the console operates with elevated privileges relative to standard user pods, it can reach internal cluster resources such as etcd, kube-apiserver, or other microservices that are not exposed externally. The vulnerability is exacerbated by the fact that partial responses from these internal requests may be reflected back to the attacker. This reflection allows for data exfiltration of sensitive configuration details, service discovery information, and potentially credentials stored in environment variables or mounted secrets within those internal services.
In addition to SSRF risks, this flaw introduces a significant Denial of Service (DoS) vector through resource exhaustion attacks. The implementation fails to properly enforce limits on request size or content length for incoming devfile payloads. An attacker can exploit this by sending repeated requests with large bodies but without specifying the Content-Length header, or by manipulating headers in ways that cause the server-side parser to buffer data indefinitely while waiting for more input. This behavior leads to unbounded memory growth within the console pod process. As these connections persist and consume increasing amounts of RAM on the node hosting the console deployment, system resources become depleted. Eventually, this resource exhaustion can crash the OpenShift Console service or impact the stability of other critical workloads running on the same infrastructure nodes, resulting in a complete loss of availability for cluster management capabilities.
From an industry standard perspective, this vulnerability maps directly to CWE-287: Improper Authentication, as unauthenticated actors are able to access restricted functionality. The SSRF component aligns with CWE-918: Server-Side Request Forgery (SSRF), where the web server makes requests from a back-end system using user-supplied input. Furthermore, the denial of service aspect relates to CWE-400: Uncontrolled Resource Consumption and CWE-770: Allocation of Resources Without Limits or Throttling. In terms of offensive security frameworks, this attack pattern corresponds to MITRE ATT&CK technique T1557: Adversary-in-the-Middle for SSRF exploitation and T1496: Resource Hijacking for the denial-of-service component via resource exhaustion.
Mitigation strategies must focus on immediate access control enforcement and input validation hardening. The most critical step is to ensure that all API endpoints, particularly those handling sensitive configuration data like devfiles, require valid authentication tokens before processing any requests. This involves reviewing the OpenShift console routing and authorization policies to restrict access to authenticated users with appropriate roles. Additionally, developers must implement strict input validation on these endpoints, including enforcing maximum payload sizes, validating Content-Length headers, and sanitizing inputs to prevent SSRF attempts by blocking internal IP ranges or non-whitelisted domains in outbound requests from the console pod. Applying vendor-provided security patches that address this specific CVE is essential for restoring the integrity of the OpenShift management plane.