Advisory · CVE-2026-75885
Unauthenticated SSRF and DoS in OpenShift console
OpenShift's console exposes devfile endpoints that let remote attackers force internal requests or exhaust console memory.
- Vendor
- Red Hat
- Product
- Red Hat OpenShift Container Platform 4
- Identifier / CWE
- CVE-2026-75885
CWE-918 - Action timing
- Immediate
Explain it like I’m five
The OpenShift dashboard has a helper that fetches files for you. A stranger can ask the helper to fetch from private addresses instead, and the helper will bring back what it finds. Ask it often enough with big requests and it runs out of memory and falls over.
- 01Open endpoints
An unauthenticated attacker reaches /api/devfile/ or /api/devfile/samples/ on the OpenShift console.
- 02Crafted payload
The attacker submits devfile payloads pointing at internal addresses.
- 03Internal requests
The console pod makes requests to internal services and reflects partial responses back to the attacker.
- 04Memory exhaustion
Repeated large requests without a content length cause unbounded memory growth and denial of service.
What happened
Red Hat disclosed CVE-2026-75885 (CVSS 9.3) in the OpenShift Container Platform 4 console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. The console pod then makes requests to internal services and reflects partial responses to the attacker (SSRF). Separately, repeated large requests without a specified content length cause unbounded memory growth in the console pod, leading to denial of service.
What to do
- Inventory OpenShift 4 clusters and confirm console exposure, including externally reachable routes.
- Apply Red Hat’s security updates for the console per the Red Hat CVE page and verify afterward.
- Restrict access to the console while patching where feasible.
- Review console and cluster logs for unusual requests to the devfile endpoints, internal address probing, or console pod restarts and OOM events.
- Assess what internal services and cloud metadata were reachable from the console pod’s network position.
Management note
The OpenShift console sits at the front door of the cluster with a privileged network position. An unauthenticated SSRF there turns the dashboard into a proxy into your internal network. Patch quickly and check what the console could reach.