Bug 2508666 (CVE-2026-66805)
| Summary: | CVE-2026-66805 console: Stored DOM XSS via unescaped pod logs in document.write | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | anpicker, dhanak, drosa, dsimansk, eborisov, gparvin, hasun, jfula, jowilson, kingland, lball, mnovotny, ngough, nyancey, ometelka, ptisnovs, rhaigner, sausingh, security-response-team, syedriko, veshanka, xdharmai |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the console component. An attacker who can write to container logs on a managed cluster can inject malicious code into the hub console user's browser session. This occurs when the user views raw pod logs, as the console does not properly escape the log content. Successful exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the console user.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The openRawTab function in LogsPage.tsx opens a new browser window and calls document.write(`<pre>${logs}</pre>`) with raw container stdout/stderr from a managed (spoke) cluster, fetched via the search/managed-cluster proxy. No HTML encoding is applied before document.write. An attacker who can write to container logs on a spoke cluster (e.g. by controlling a pod's stdout) can inject arbitrary HTML/JavaScript that executes in the hub console user's browser session when they click "Raw" on the pod logs page. This enables session hijacking, credential theft, or actions on behalf of the console user. Affected file: frontend/src/routes/Home/Search/Details/LogsPage.tsx (lines 108-111) Fix branch: glasswing/f002 Engineering contact: Kevin Cormier Jira: ACM-38692 Discovered by: Project Glasswing AI-SAST campaign (HP Mythos)