Vendor
The osac-operator console-proxy component fails to sanitize kubeconfig data, potentially allowing Remote Code Execution (RCE) via exec plugins or Server-Side Request Forgery (SSRF) via crafted cluster server definitions.