← All Advisories

CVE-2026-50236

Last refreshed2026-10-03

Status: UPDATED  |  Advisory ID: CVE-2026-50236

Key Details

CVECVE-2026-50236
CVSS Score / Version7.4 (High) / CVSS v3.1
Updated2026-09-21
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS Proseattack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is changed; confidentiality impact is low; integrity impact is low; availability impact is low.
Affected productssee table below
Classified asCWE-918 (Server-Side Request Forgery (SSRF))

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
Red HatRed Hat OpenShift Container Platform 4.14
Red HatRed Hat OpenShift Container Platform 4.15
Red HatRed Hat OpenShift Container Platform 4.16
Red HatRed Hat OpenShift Container Platform 4.17
Red HatRed Hat OpenShift Container Platform 4.18
Red HatRed Hat OpenShift Container Platform 4.19
Red HatRed Hat OpenShift Container Platform 4.20
Red HatRed Hat OpenShift Container Platform 4.21
Red HatRed Hat OpenShift Container Platform 4.22
SubsystemsGeneral OT
SectorsMultiple

What to Know

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. (NVD)

What to Do

Monitor Red Hat's web page for any future patch releases.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-50236
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-50236

About

OT-Advisories  ·  CVE  ·  NVD  ·  CVSS  ·  KEV  ·  EPSS  ·  CWE