{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aosac_projectosac_operator/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:osac_project:osac_operator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-62284"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["osac-operator (\u003c 0.0.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["osac-project"],"content_html":"\u003cp\u003eThe console-proxy's RemoteConfigResolver in osac-operator parses kubeconfig data from Kubernetes Secrets without sanitizing the resulting \u003ccode\u003erest.Config\u003c/code\u003e.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eRemote Code Execution (RCE):\u003c/strong\u003e A kubeconfig containing an \u003ccode\u003eexec\u003c/code\u003e plugin stanza (under \u003ccode\u003eusers[].user.exec\u003c/code\u003e) is preserved. When the transport is built, \u003ccode\u003eclient-go\u003c/code\u003e invokes the exec plugin, spawning an arbitrary process as the \u003ccode\u003eosac-console-proxy\u003c/code\u003e service account. This is possible for any principal that can create or modify a Secret with the label \u003ccode\u003eosac.openshift.io/remote-cluster-kubeconfig: \u0026quot;true\u0026quot;\u003c/code\u003e in a namespace where the proxy has Secret read access.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSSRF:\u003c/strong\u003e A secondary vector exists via attacker-controlled \u003ccode\u003eclusters[].server\u003c/code\u003e definitions, enabling SSRF from within the proxy pod.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eAffected configurations include any deployment using remote or auto VM cluster mode.\u003c/p\u003e\n","date_modified":"2026-11-07T09:41:29Z","date_published":"2026-11-07T09:41:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-osac-operator-kubeconfig-rce/","summary":"The osac-operator console-proxy component fails to sanitize kubeconfig data, potentially allowing Remote Code Execution (RCE) via exec plugins or Server-Side Request Forgery (SSRF) via crafted cluster server definitions.","title":"osac-operator: Remote code execution and SSRF in console-proxy (CVE-2026-62284)","url":"https://feed.craftedsignal.io/briefs/2026-11-osac-operator-kubeconfig-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:osac_project:osac_operator:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}