CVE-2026-75887 – Red Hat OpenShift Container Platform 4.12

This Red Hat OpenShift Container Platform 4.12 update fixes two flaws in the OpenShift console. Attackers can reach both without authentication. CVE-2026-75885 has a CVSS score of 9.3, Critical severity. It lets a remote attacker send crafted devfile payloads to the console's devfile endpoints. The console pod then sends requests to internal services and returns parts of their responses to the attacker, a server-side request forgery. The same endpoints also let repeated large requests grow memory without limit, which can take the console down.

CVE-2026-75887 has a CVSS score of 7.5, High severity. It is a path traversal flaw in the console's locale resource endpoint. Attackers can read sensitive JSON files from the pod filesystem, including plugin manifests and configuration files, and reach registered dynamic-plugin backends. This flaw is also classified as an elevation of privilege. Together, these flaws give an unauthenticated outsider a view into internal services and cluster configuration. Apply this update the same day.