CVE-2026-75886

Name of the Vulnerable Software and Affected Versions openshift/console (affected versions not specified)

Description A misconfiguration in the CatalogdHandler allows an unauthenticated remote attacker to bypass authentication. By leveraging the forwarding of the openshift-session-token cookie, an attacker can send requests to the in-cluster catalogd service. This results in the disclosure of the internal operator-catalog index and provides a relay into the openshift-catalogd namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.