On this page
Red Hat has published fixes for CVE-2026-75885 across seven OpenShift 4 trains. The issue affects unauthenticated Devfile parser endpoints in the OpenShift console and can enable server-side request forgery against internal services plus resource-exhaustion denial of service.
Red Hat rates the vulnerability Important with CVSS 9.3. Its current security record lists fixed affected releases for OpenShift 4.12, 4.17, 4.18, 4.19, 4.20, 4.21, and 4.22.
Fixed releases
- OpenShift 4.12: 4.12.99, RHSA-2026:70647
- OpenShift 4.17: 4.17.58, RHSA-2026:70587
- OpenShift 4.18: 4.18.56, RHSA-2026:70617
- OpenShift 4.19: 4.19.49, RHSA-2026:71447
- OpenShift 4.20: 4.20.40, RHSA-2026:71450
- OpenShift 4.21: 4.21.35, RHSA-2026:71453
- OpenShift 4.22: 4.22.16, RHSA-2026:71454
Upgrade to the fixed release for the OpenShift train you operate. Red Hat still states that no mitigation meets its Product Security criteria, so network exposure restrictions should be treated as defense in depth, not as a substitute for the vendor fix.
What the vulnerability does
Unauthenticated access to /api/devfile/ and /api/devfile/samples/ can cause the console pod to make requests to internal services and reflect partial responses. Repeated large requests without a content length can also cause unbounded memory growth and denial of service.
Scope
This record is specific to the OpenShift console Devfile endpoints. The authenticated Dev Console webhook SSRF tracked as CVE-2026-50236 is a separate issue. Non-OpenShift Kubernetes dashboards are not affected by CVE-2026-75885.
Operator action
Identify the OpenShift train in use, apply the fixed release above, and confirm the console deployment has completed its rollout. If the console route is exposed beyond trusted networks, reduce that exposure until the update is complete.
