Unauthenticated Information Disclosure in OpenShift Console via CatalogdHandler

CVE-2026-75886 affects the Red Hat OpenShift Console, specifically within the CatalogdHandler component. The vulnerability arises from a lack of mandatory authentication checks coupled with the improper forwarding of the openshift-session-token cookie. This configuration error enables an unauthenticated remote attacker to interact directly with the in-cluster catalogd service. By successfully leveraging this flaw, an attacker can exfiltrate sensitive internal operator-catalog index information. Furthermore, the vulnerability provides a relay vector into the openshift-catalogd namespace, potentially exposing cluster-internal services that are intended to be shielded from external access. This is a critical risk for organizations relying on OpenShift for container orchestration, as it facilitates unauthorized reconnaissance and potential lateral movement into internal cluster management components.

Impact

Successful exploitation allows unauthenticated remote attackers to gain unauthorized access to internal operator-catalog index information. Beyond the disclosure of sensitive infrastructure metadata, the ability to relay requests into the openshift-catalogd namespace may allow an attacker to reach or interact with other internal cluster-catalog components that lack secondary authentication, potentially escalating access within the internal network segment.

Recommendation

• Monitor web application logs for unauthorized POST or GET requests to catalog-related API endpoints originating from outside the cluster internal network.
• Review cluster ingress and network policy configurations to limit access to the OpenShift Console and ensure that internal services like catalogd are not exposed to external traffic.
• Update OpenShift Console to the latest patched version provided by Red Hat as soon as the security advisory for CVE-2026-75886 is released.