BREAKING: OpenShift console Devfile API lets anyone SSRF your cluster

Anyone who can reach your OpenShift console Route can POST to the Devfile parser with no login, and the console pod will fetch internal URLs and chew memory until it falls over. Red Hat published CVE-2026-75885 today as Important (preliminary CVSS 9.3, CWE-918). The hole is unauthenticated access to /api/devfile/ and /api/devfile/samples/ in the OpenShift console (bridge). There is no RHSA and no Fixed In Version yet. Restrict who can reach the console Route now, and watch access.redhat.com for the errata.

This is the operator write-up. The HOL Guard evidence pack for CVE-2026-75885 is the source record. Do not open a second article for the authenticated Dev Console webhook SSRF sibling CVE-2026-50236; that one needs a login. This one does not.

What breaks

Red Hat’s advisory: unauthenticated access to the Devfile endpoints lets a remote attacker send crafted Devfile payloads. The console pod then makes requests to internal services (SSRF) and can reflect partial responses. Repeated large requests without a content length can drive unbounded memory growth and DoS.

Bugzilla 2517885 (status NEW, Fixed In Version empty) is more specific. In pkg/server/server.go, /api/devfile/ and /api/devfile/samples/ are registered with handleFunc() and are not wrapped in authHandler / authHandlerWithUser the way other /api/* routes are. DevfileHandler decodes an arbitrary JSON body and calls ParseDevfileAndValidate. The Devfile library resolves parent.uri, Dockerfile.uri, and remote plugin references over HTTP from the console pod. There is no MaxBytesReader / body size limit. Partial response bytes show up in the parser error string (partial-read SSRF). The reporter reproduced this on an OCP 5.0 nightly. Upstream tree: openshift/console.

Red Hat scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L (9.3 Important), marks mitigation as not available under their Product Security criteria, and notes scores are preliminary. Impact in plain terms: an unauthenticated caller who can hit the console Route can use the console pod as a proxy into the cluster network and can DoS the console process with large bodies.

Who is not in scope

Clusters where the OpenShift console Route is not reachable from the attacker (strict network policy, private console only, no public Route) remove the unauthenticated blast radius for this CVE, but that is exposure control, not a patch. Installs that do not run the OpenShift console / bridge are out of scope. Authenticated-only Dev Console webhook SSRF tracked as CVE-2026-50236 is a different bug with a login requirement; do not treat a fix for one as coverage for the other. Non-OpenShift Kubernetes dashboards (vanilla kube-dashboard, Rancher UI, etc.) are not this CVE.

How to check

From a host that can reach the console Route, without a session cookie or OAuth token, probe whether the Devfile endpoint accepts an unauthenticated POST (expect a parser error JSON, not a 401/403 redirect to login):

# Replace CONSOLE with your console Route base URL (no trailing slash)
# A 401/403/login redirect is healthy. A 200/4xx parser body without auth is the bad path.
curl -sk -o /tmp/devfile-probe.body -w "HTTP %{http_code}\n" \
  -X POST "$CONSOLE/api/devfile/" \
  -H "Content-Type: application/json" \
  -d '{"content":"schemaVersion: 2.2.0\nmetadata:\n  name: probe\n"}'

# Also confirm which console image your cluster runs
oc get deployment console -n openshift-console -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
oc get route console -n openshift-console -o jsonpath='{.spec.host}{"\n"}'

If the POST returns application JSON from the Devfile parser with no auth challenge, treat the Route as exposed to CVE-2026-75885 until Red Hat ships a console build that wraps those routes in auth and caps body size. Keep the probe payload tiny and stop after one request; do not load-test production.

How to fix

There is no public RHSA / Fixed In Version yet (Bugzilla 2517885 still NEW with an empty Fixed In Version field as of this writing). Red Hat lists mitigation as not available under their criteria. Until errata lands:

# 1) Restrict who can reach the console Route (NetworkPolicy / ingress / private API only)
# 2) Watch for the RHSA on the CVE page, then upgrade the console operator / console image
#    https://access.redhat.com/security/cve/CVE-2026-75885
#
# After an RHSA ships, apply the errata the usual way for your OCP train, for example:
#   oc adm upgrade --to=<errata-recommended-version>
# or follow the RHSA package list for the console image digest.
#
# Re-run the unauthenticated POST probe above and confirm you get auth failure, not parser output.

Do not invent a version number. When Red Hat publishes Fixed In Version / RHSA, upgrade that build and re-check the probe. Interim control is network exposure of the console Route, not a config flag named in the advisory.

What this is not

This is not remote code execution on the cluster and not a claim that every OpenShift install on the public internet is already owned. It is unauthenticated SSRF plus resource-exhaustion DoS through two Devfile API routes on the console, with Scope Changed and Confidentiality High on Red Hat’s preliminary 9.3. It is not the authenticated Dev Console webhook SSRF (CVE-2026-50236). It is not “wait for NVD analysis before acting”: if your console Route is reachable, shrink exposure today and watch for the RHSA.

References

• Red Hat CVE-2026-75885
• Bugzilla 2517885
• CVE-2026-75885 (CVE Program)
• NVD CVE-2026-75885
• openshift/console (upstream)