CVE-2026-50236 Server-side request forgery in Red Hat OpenShift Container Platform 4.14
Authenticated attackers can exploit SSRF in OpenShift Console webhook helpers to read arbitrary internal endpoints via full response reflection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50236?
CVE-2026-50236 is a high-severity server-side request forgery vulnerability in Red Hat OpenShift Container Platform 4.14, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
Weakness: CWE-918
Which versions are affected by CVE-2026-50236?
How do I fix CVE-2026-50236?
No fix has been published for CVE-2026-50236 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-50236 being exploited?
There is no known exploitation of CVE-2026-50236 in the wild and no public exploit code.
Sources
Also known as CVE-2026-75890, GHSA-c4v8-c9cj-xrmr.