OpenShift console unauth Devfile SSRF and DoS
Direct answer
OpenShift console unauth Devfile SSRF and DoS, also tracked as CVE-2026-75885 / OpenShift console Devfile SSRF is a critical-severity threat campaign HOL Guard tracked from Sep 18, 2026 to Sep 18, 2026, verified against 3 primary sources and last reviewed Sep 20, 2026. Active tracking has ended and the record remains published as a permanent historical research record.
Unauthenticated callers can hit OpenShift console `/api/devfile/` and `/api/devfile/samples/` with crafted Devfile payloads, driving SSRF toward internal services and unbounded memory growth for DoS. Red Hat rates this Important (CVSS 9.3) and currently lists the affected console components without errata or a fixed build.
Also tracked as CVE-2026-75885 · OpenShift console Devfile SSRF
- First observed
- Sep 18, 2026
- Last observed
- Sep 18, 2026
- Last reviewed
- Sep 20, 2026
- Tracking ended
- Sep 18, 2026
Record exports
Uncertainty and limitations
Read the evidence limits before acting on this record.
Red Hat currently lists the OpenShift console components as Affected, with no errata and no qualifying mitigation published on the cited CVE page. A fix may be released later; verify the current Red Hat CVE and RHSA state before treating any train as patched.
- The cited Red Hat CVE currently lists both OpenShift console components as Affected and shows no errata. Do not infer a patched train until Red Hat publishes one.
- Red Hat currently lists no mitigation meeting its Product Security criteria. Exposure reduction does not establish that the vulnerability is remediated.
- This campaign covers console Devfile SSRF/DoS, not unrelated OpenShift control-plane CVEs.
Guard coverage and policy
What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.
No Guard coverage mapping or campaign-specific policy guidance is published for this record.
Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
Timeline
Reviewed events, oldest first, each tied to a verified source.
- Disclosure
CVE-2026-75885 disclosed: unauthenticated SSRF and resource exhaustion via OpenShift console Devfile parser endpoints.
- Update
HOL Guard published BREAKING operator coverage and company social for CVE-2026-75885.
Source:HOL Guard operator write-up
- Correction
Patch availability corrected: current Red Hat primary sources list the console components as affected with no errata or fixed version, so the record no longer tells operators that an RHSA or patched build is already available.
Publication clock: 38.9 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; historical backfill outside target.
Reviewed artifacts
The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.
openshift/console@affected; fixed build not yet listed by cited Red Hat sourceopenshiftpackage
Sources
Every claim on this record is traceable to the sources below.
Campaign questions, answered
Unauthenticated callers can hit OpenShift console `/api/devfile/` and `/api/devfile/samples/` with crafted Devfile payloads, driving SSRF toward internal services and unbounded memory growth for DoS. Red Hat rates this Important (CVSS HOL Guard tracked the campaign from Sep 18, 2026 to Sep 18, 2026.
No. Active tracking ended Sep 18, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.
The record cites 3 primary sources, names 1 reviewed artifact, and was last fully reviewed Sep 20, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.
Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.
The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Red Hat currently lists the OpenShift console components as Affected, with no errata and no qualifying mitigation published on the cited CVE page.
Reviewed in full by HOL Guard Security Publishing.
- Published
- Last full review
- Last modified
Record HGTC-2026-BFAD196C