CVE-2026-50236: Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

A flaw was found in the OpenShift Console Dev Console webhook helper endpoints. The /api/dev-console/webhooks/github, /gitlab, and /bitbucket endpoints accept user-supplied hostName/baseURL parameters and perform server-side HTTP POST requests from the openshift-console pod to arbitrary URLs without URL validation or private-range blocking. By appending a query separator (?) to the hostName, the attacker neutralizes the fixed URL suffix and gains full path control, making this a general-purpose authenticated HTTP POST proxy. The full target response (status code, headers, and body) is reflected back to the caller without size limits. Any authenticated console user, including those with no project access, can exploit this to reach cluster-internal HTTP services from the console pod network position with arbitrary POST bodies and attacker-specified headers. The header denylist uses case-sensitive exact matching, allowing bypass of Cookie and X-CSRFToken filtering via case variants. No HTTP client timeout or response body size limit is enforced.