Bug 2517889 (CVE-2026-75887)
| Summary: | CVE-2026-75887 openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, security-response-team, sghai, sidsharm, suppawar, vlaad |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The /locales/resource.json endpoint in the OpenShift console is registered without authHandler (pkg/server/server.go:544-546). The lng and ns query parameters are taken directly from user input with no sanitization (pkg/plugins/handlers.go:95-132). When ns does not have the "plugin__" prefix, the handler calls http.ServeFile with path.Join(p.PublicDir, "locales", lang, fmt.Sprintf("%s.json", namespace)). path.Join cleans ".." but does not confine the result under PublicDir. http.ServeFile's built-in ".." guard only inspects r.URL.Path, not the name argument. An unauthenticated attacker can read any *.json file from the pod filesystem, including ConfigMap-mounted plugin manifests and configuration files. When ns has the "plugin__" prefix, the unsanitized lang is injected into the request path sent to plugin services, enabling path traversal against every registered dynamic-plugin backend. Tested and reproduced on OCP 5.0 nightly cluster. Upstream: https://github.com/openshift/console File: pkg/server/server.go:544-546, pkg/plugins/handlers.go:95-132