Bug 2517885 (CVE-2026-75885)
| Summary: | CVE-2026-75885 openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The /api/devfile/ and /api/devfile/samples/ endpoints in the OpenShift console (bridge) are registered with handleFunc() directly, without being wrapped in authHandler or authHandlerWithUser like every other /api/* route (pkg/server/server.go:347-348). DevfileHandler decodes an arbitrary JSON body and passes DevfileContent to devfile.ParseDevfileAndValidate(parser.ParserArgs{Data: ..., HTTPTimeout: &httpTimeout}). The devfile library resolves parent.uri, kubernetes.uri, and remote plugin references over HTTP from the console pod. No request-body size limit is applied (MaxBytesReader is absent). An unauthenticated attacker on the OpenShift Route can send a crafted devfile payload with parent.uri pointing to internal services (e.g. cloud metadata endpoints, etcd, kubelets). The response body is reflected in the parser error string returned to the client, yielding partial-read SSRF. Repeated large-body POSTs without Content-Length cause unbounded memory growth (DoS). Tested and reproduced on OCP 5.0 nightly cluster. Upstream: https://github.com/openshift/console File: pkg/server/server.go:347-348, pkg/devfile/handler.go:37-67