A flaw was found in the OpenShift Console Helm catalog proxy. A tenant with namespace edit permissions can create a ProjectHelmChartRepository (PHCR) resource with an arbitrary spec.connectionConfig.url. When any user browses the namespace Helm catalog, the openshift-console pod fetches that URL server-side without URL validation or private-range blocking. The tenant can supply custom CA certificates, TLS client certificates, and basic authentication credentials from namespace-scoped ConfigMaps and Secrets that the console pod consumes for the outbound request, enabling the console to present attacker-controlled authentication identities. The console pod fetch bypasses tenant namespace egress NetworkPolicy restrictions. Tenant-controlled chart metadata with trust-spoofed annotations is preserved in the aggregated catalog response visible to other users. Additionally, if a cluster-admin installs a tenant-planted chart through the console UI, cluster-scoped resources (ClusterRole, ClusterRoleBinding) are created under admin authority, enabling admin-mediated privilege escalation. Same-namespace Helm catalog availability can be degraded by planting multiple slow-responding PHCRs.