Osac-Operator (< 0.0.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/osac-operator--0.0.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 09:41:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgosac-operator: Remote code execution and SSRF in console-proxy (CVE-2026-62284)https://feed.craftedsignal.io/briefs/2026-11-osac-operator-kubeconfig-rce/Sat, 07 Nov 2026 09:41:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-osac-operator-kubeconfig-rce/The osac-operator console-proxy component fails to sanitize kubeconfig data, potentially allowing Remote Code Execution (RCE) via exec plugins or Server-Side Request Forgery (SSRF) via crafted cluster server definitions.The console-proxy's RemoteConfigResolver in osac-operator parses kubeconfig data from Kubernetes Secrets without sanitizing the resulting rest.Config.

  1. Remote Code Execution (RCE): A kubeconfig containing an exec plugin stanza (under users[].user.exec) is preserved. When the transport is built, client-go invokes the exec plugin, spawning an arbitrary process as the osac-console-proxy service account. This is possible for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy has Secret read access.
  2. SSRF: A secondary vector exists via attacker-controlled clusters[].server definitions, enabling SSRF from within the proxy pod.

Affected configurations include any deployment using remote or auto VM cluster mode.

]]>highadvisory