CVE-2026-50237: Red Hat Openshift Container Platform 4.12

High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days.

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation.

Affected products

Red Hat Red Hat Openshift Container Platform 4.12: before 1786511587 (fixed in 1786511587)
Red Hat Red Hat Openshift Container Platform 4.13: before 1786477760 (fixed in 1786477760)
Red Hat Red Hat Openshift Container Platform 4.14: before 1787056403 (fixed in 1787056403)
Red Hat Red Hat Openshift Container Platform 4.15: before 1787028559 (fixed in 1787028559)
Red Hat Red Hat Openshift Container Platform 4.16: before 1787054159 (fixed in 1787054159)
Red Hat Red Hat Openshift Container Platform 4.17: before 1787631382 (fixed in 1787631382)
Red Hat Red Hat Openshift Container Platform 4.18: before 1786540776 (fixed in 1786540776)
Red Hat Red Hat Openshift Container Platform 4.19: before 1786486822 (fixed in 1786486822)
Red Hat Red Hat Openshift Container Platform 4.20: before 1786534931 (fixed in 1786534931)
Red Hat Red Hat Openshift Container Platform 4.21: before 1786574043 (fixed in 1786574043)
Red Hat Red Hat Openshift Container Platform 4.22: before 1786607915 (fixed in 1786607915)

Published 2026-08-11. Last modified 2026-09-21.