Yüksek CVSS 7.4
CVE-2026-50237: CVE-2026-50237: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
Özet bilgiler
- CVSS v3.1
- 7.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L - EPSS
- %0,47 (yüzdelik 41)
- CWE
- CWE-918
- Yama
- Yok / bilinmiyor