Live › vulnerability › CVE-2026-62284
The OSAC operator's console-proxy parses kubeconfig Secrets without sanitizing them, so anyone who can create or modify a labeled Secret in a namespace the proxy can read can make it execute an arbitrary process. The same Secret can point the proxy at attacker-chosen server addresses, enabling server-side request forgery from the proxy pod.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 20:25 UTC. All times on this page are UTC.
Exposure requires the console-proxy to run in remote or auto VM cluster mode and a RoleBinding that gives it Secret read access in a namespace where someone can write labeled Secrets. Clusters that run only in local mode do not read kubeconfig Secrets and can skip this.
No product ranges from the sources yet.
remote or auto VM cluster mode; local-only mode is not affected.osac.openshift.io/remote-cluster-kubeconfig: "true" and the RoleBindings that grant the proxy Secret read access in those namespaces.8220502 or otherwise predates commit 7e4222b.7e4222b.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secret labeled osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply users[].user.exec. When rest.TransportFor builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-console-proxy service account inside the pod. Attacker-controlled clusters[].server also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively local mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.
This page as .md · .json · in your agent: get_signal("CVE-2026-62284")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.