Unauthenticated SSRF and DoS in OpenShift Console

CVE-2026-75885 affects the OpenShift console, exposing internal services to unauthorized interaction and threatening service availability. The vulnerability resides in the improper validation of inputs provided to the /api/devfile/ and /api/devfile/samples/ endpoints. By submitting crafted devfile payloads, an unauthenticated remote attacker can force the console pod to perform requests against internal infrastructure, facilitating Server-Side Request Forgery (SSRF) and potentially exposing sensitive internal data through reflected responses. Furthermore, the absence of Content-Length header enforcement allows an attacker to stream large, unconstrained request bodies. This triggers uncontrolled memory allocation within the console pod, leading to pod instability and Denial of Service (DoS). This vulnerability is critical for organizations relying on OpenShift for container orchestration, as the console pod often possesses high-level access within the cluster environment.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to probe internal microservices or orchestrate a DoS condition on the OpenShift management layer. This can lead to the exfiltration of internal service metadata or the complete disruption of administrative console functions, affecting all teams relying on the platform for cluster management. The CVSS score of 9.3 reflects the high risk of unauthenticated remote compromise.

Recommendation

• Monitor web server access logs for any unauthenticated POST requests targeting the /api/devfile/ or /api/devfile/samples/ paths.
• Implement network-level restrictions or Web Application Firewall (WAF) policies to block unauthenticated access to the OpenShift console management API.
• Ensure the OpenShift environment is updated to the latest vendor-provided patch releases that remediate CVE-2026-75885.