CVE-2026-75887 in OpenShift Container Platform
Summary
by MITRE • 09/24/2026
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The identified vulnerability represents a critical security deficiency within the OpenShift console interface, specifically targeting the localization resource endpoint located at /locales/resource.json. This flaw stems from insufficient input validation regarding query parameters used to determine language and namespace contexts for localized content delivery. An unauthenticated attacker can exploit this weakness by manipulating the lng and ns parameters to inject directory traversal sequences into the file path resolution logic. By carefully constructing these requests, an adversary can bypass intended access controls and traverse outside the designated locale directories to access arbitrary files stored on the pod filesystem. This capability effectively neutralizes the isolation boundaries that are supposed to protect sensitive configuration data from unauthorized external access.
The technical mechanism of this vulnerability relies on the improper sanitization of user-supplied input before it is used in file system operations. When the console processes requests for resource.json, it constructs a path based on the provided language and namespace parameters without adequately restricting the depth or direction of directory traversal sequences such as dot-dot-slash combinations. This allows an attacker to read sensitive JSON files that contain plugin manifests, internal configuration settings, and potentially other critical application data. The impact extends beyond static file reading, as the vulnerability also enables path traversal against registered dynamic-plugin backends. These backends often handle complex logic and may expose additional attack surfaces if their underlying file paths are susceptible to similar manipulation through the same or related endpoints.
From an operational perspective, this flaw poses a severe risk to cluster integrity and data confidentiality. Accessing plugin manifests can reveal details about installed extensions, their versions, and internal architectures, which aids in further reconnaissance by attackers seeking additional vulnerabilities. Reading configuration files may expose secrets, API keys, or network topology information that should remain confidential. Furthermore, the ability to traverse paths against dynamic-plugin backends could lead to remote code execution if those plugins process file contents insecurely or if sensitive data is logged or exposed through error messages. This vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and falls under ATT&CK technique T1083 File and Directory Discovery, indicating its potential use in early stages of an attack chain for information gathering before more destructive actions are taken.
Mitigation strategies must focus on strict input validation and secure coding practices within the console application codebase. Developers should implement allowlist-based validation for all query parameters to ensure they only contain expected alphanumeric characters or specific safe symbols, rejecting any input containing traversal sequences immediately. Additionally, using canonical path resolution functions that normalize paths before accessing files can prevent directory escape attempts even if malicious inputs bypass initial checks. Implementing robust access controls and authentication requirements for internal endpoints would also reduce the attack surface by ensuring only authenticated users with appropriate privileges can request resource data. Regular security audits and static code analysis tools should be employed to detect similar path traversal weaknesses across other parts of the application, particularly in modules handling file system interactions or dynamic plugin management.