CVE-2026-75887: Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
Other sources
The /locales/resource.json endpoint in the OpenShift console is registered without authHandler (pkg/server/server.go:544-546). The lng and ns query parameters are taken directly from user input with no sanitization (pkg/plugins/handlers.go:95-132).
When ns does not have the "plugin" prefix, the handler calls http.ServeFile with path.Join(p.PublicDir, "locales", lang, fmt.Sprintf("%s.json", namespace)). path.Join cleans ".." but does not confine the result under PublicDir. http.ServeFile's built-in ".." guard only inspects r.URL.Path, not the name argument.
An unauthenticated attacker can read any .json file from the pod filesystem, including ConfigMap-mounted plugin manifests and configuration files. When ns has the "plugin" prefix, the unsanitized lang is injected into the request path sent to plugin services, enabling path traversal against every registered dynamic-plugin backend.
Tested and reproduced on OCP 5.0 nightly cluster.
Upstream: https://github.com/openshift/console File: pkg/server/server.go:544-546, pkg/plugins/handlers.go:95-132
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Does an attacker need an OpenShift account or any other credentials to exploit this issue?
No. The affected endpoint is registered without an authentication handler, so an unauthenticated attacker can target it remotely.
What data could be exposed through this vulnerability?
The flaw can expose JSON files from the console pod filesystem, including ConfigMap-mounted plugin manifests and configuration files. The disclosure is limited to files matching the JSON extension in the described file-serving path.
Are dynamic plugins relevant to the impact?
Yes. Requests using a namespace with the "plugin__" prefix can enable path traversal against registered dynamic-plugin backends.