Bug 2484745 (CVE-2026-50236)

Summary: CVE-2026-50236 openshift/console: Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-08-11   

Description OSIDB Bzimport 2026-06-04 12:12:07 UTC 
A flaw was found in the OpenShift Console Dev Console webhook helper endpoints. The /api/dev-console/webhooks/github, /gitlab, and /bitbucket endpoints accept user-supplied hostName/baseURL parameters and perform server-side HTTP POST requests from the openshift-console pod to arbitrary URLs without URL validation or private-range blocking. By appending a query separator (?) to the hostName, the attacker neutralizes the fixed URL suffix and gains full path control, making this a general-purpose authenticated HTTP POST proxy. The full target response (status code, headers, and body) is reflected back to the caller without size limits. Any authenticated console user, including those with no project access, can exploit this to reach cluster-internal HTTP services from the console pod network position with arbitrary POST bodies and attacker-specified headers. The header denylist uses case-sensitive exact matching, allowing bypass of Cookie and X-CSRFToken filtering via case variants. No HTTP client timeout or response body size limit is enforced.