CVE-2026-50237: Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console
A flaw was found in the OpenShift Console Helm catalog proxy. A tenant with namespace edit permissions can create a ProjectHelmChartRepository (PHCR) resource with an arbitrary spec.connectionConfig.url. When any user browses the namespace Helm catalog, the openshift-console pod fetches that URL server-side without URL validation or private-range blocking. The tenant can supply custom CA certificates, TLS client certificates, and basic authentication credentials from namespace-scoped ConfigMaps and Secrets that the console pod consumes for the outbound request, enabling the console to present attacker-controlled authentication identities. The console pod fetch bypasses tenant namespace egress NetworkPolicy restrictions. Tenant-controlled chart metadata with trust-spoofed annotations is preserved in the aggregated catalog response visible to other users. Additionally, if a cluster-admin installs a tenant-planted chart through the console UI, cluster-scoped resources (ClusterRole, ClusterRoleBinding) are created under admin authority, enabling admin-mediated privilege escalation. Same-namespace Helm catalog availability can be degraded by planting multiple slow-responding PHCRs.
Other sources
A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Which users can initiate the server-side request, and what causes it to be sent?
A tenant with edit permissions in a namespace can create a ProjectHelmChartRepository with an arbitrary connectionConfig URL. The openshift-console pod fetches that URL when any user browses the Helm catalog for that namespace.
Do tenant egress NetworkPolicies prevent exploitation?
No. The request is made by the openshift-console pod, so it bypasses egress NetworkPolicy restrictions applied to the tenant namespace.
Can an attacker make the console authenticate to a target using attacker-selected credentials?
Yes. The tenant can provide custom CA certificates, TLS client certificates, and basic authentication credentials through namespace-scoped ConfigMaps and Secrets consumed by the console for the outbound request.
When does this become a cluster-level privilege escalation?
Cluster-level escalation requires a cluster-admin to install a tenant-planted chart through the console UI. The chart can then create cluster-scoped resources such as ClusterRole and ClusterRoleBinding under the administrator's authority.
What non-SSRF impacts should triage consider?
Tenant-controlled chart metadata and trust-spoofed annotations can be preserved in the catalog shown to other users. An attacker can also plant multiple slow-responding ProjectHelmChartRepository resources to degrade Helm catalog availability within the same namespace.