Skip to content
Threat Feed
Subscribe
high advisory

osac-operator: Remote code execution and SSRF in console-proxy (CVE-2026-62284)

The osac-operator console-proxy component fails to sanitize kubeconfig data, potentially allowing Remote Code Execution (RCE) via exec plugins or Server-Side Request Forgery (SSRF) via crafted cluster server definitions.

CVE search metadata

CVE search record: CVE-2026-62284. EPSS: 0.51%. KEV: no. Product: osac-operator (< 0.0.4). Brief: osac-operator: Remote code execution and SSRF in console-proxy (CVE-2026-62284). Brief link: https://feed.craftedsignal.io/briefs/2026-11-osac-operator-kubeconfig-rce/

Triage facts

Revision 1
Applicability
osac-operator (< 0.0.4)
Evidence
Unknown
Severity
High
Sources
2 public sources
Freshness
Revision 1Nov 7, 09:41 UTC
Vulnerabilities
1 CVE
Source quality
B2Roughly even chance

The console-proxy's RemoteConfigResolver in osac-operator parses kubeconfig data from Kubernetes Secrets without sanitizing the resulting rest.Config.

  1. Remote Code Execution (RCE): A kubeconfig containing an exec plugin stanza (under users[].user.exec) is preserved. When the transport is built, client-go invokes the exec plugin, spawning an arbitrary process as the osac-console-proxy service account. This is possible for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy has Secret read access.
  2. SSRF: A secondary vector exists via attacker-controlled clusters[].server definitions, enabling SSRF from within the proxy pod.

Affected configurations include any deployment using remote or auto VM cluster mode.