CVE-2026-75885criticalCWE-918

CVE-2026-75885: critical vulnerability in Red Hat OpenShift Container Platform 4.12

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint

Published 18 Sep 2026 · Updated 23 Oct 2026

Follow this CVE + Monitor Red Hat OpenShift Container Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.7%

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Affected products

Related CVEs — Red Hat OpenShift Container Platform 4.12

In the same product, most dangerous first.

CVE-2024-6387HIGHOpenssh: regresshion - race condition in ssh allows rce/dosEPSS 99.5%CVE-2024-6409HIGHOpenssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9EPSS 27.9%CVE-2024-12085HIGHRsync: info leak via uninitialized stack contentsEPSS 8.6%CVE-2026-16445HIGHDracut: dracut: root code execution via dhcp options command injection in networkmanager initrd moduleEPSS 3.2%CVE-2026-4408CRITICALSamba: remote code execution in samrEPSS 2.5%CVE-2024-7387CRITICALOpenshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyEPSS 2.3%

References