CVE-2026-50236: Red Hat Openshift Container Platform 4.14

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position.

Affected products

• Red Hat Red Hat Openshift Container Platform 4.14: before 1787056403 (fixed in 1787056403)
• Red Hat Red Hat Openshift Container Platform 4.15: before 1787028559 (fixed in 1787028559)
• Red Hat Red Hat Openshift Container Platform 4.16: before 1787054159 (fixed in 1787054159)
• Red Hat Red Hat Openshift Container Platform 4.17: before 1787631382 (fixed in 1787631382)
• Red Hat Red Hat Openshift Container Platform 4.18: before 1786540776 (fixed in 1786540776)
• Red Hat Red Hat Openshift Container Platform 4.19: before 1786486822 (fixed in 1786486822)
• Red Hat Red Hat Openshift Container Platform 4.20: before 1786534931 (fixed in 1786534931)
• Red Hat Red Hat Openshift Container Platform 4.21: before 1786574043 (fixed in 1786574043)
• Red Hat Red Hat Openshift Container Platform 4.22: before 1786607915 (fixed in 1786607915)

Published 2026-08-11. Last modified 2026-09-21.