CVE-2026-75885

Name of the Vulnerable Software and Affected Versions OpenShift console (affected versions not specified)

Description Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can result in Server-Side Request Forgery (SSRF), a condition where the console pod makes requests to internal services and reflects partial responses back to the attacker. Furthermore, sending repeated large requests without a specified content length can cause unbounded memory growth, leading to a Denial of Service (DoS).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Lock down the OpenShift console Route to restrict access. Restrict access to the /api/devfile/ and /api/devfile/samples/ endpoints to minimize the risk of exploitation.