Veille CVE

Mardi 11 août 2026

2 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Container Platform 4.20 » ✕
  1. CVE-2026-50237 7.4 Élevée

    Red Hat OpenShift Container Platform 4.12 · Red Hat OpenShift Container Platform 4.13 · Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.15

    A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

  2. CVE-2026-50236 7.4 Élevée

    Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.15 · Red Hat OpenShift Container Platform 4.16 · Red Hat OpenShift Container Platform 4.17

    An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.