Description
A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft a URL and inject arbitrary text onto the error page that appears to be from the OpenShift instance. This attack could potentially convince a user that the inserted text is legitimate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openshift/console | 3.11 and 4.x | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.248-1.git.0.92ee8ac.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.248-1.git.1.cc96c2d.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 | RHSA-2020:2992 |
Advisories 2
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- RHSA-2020:2992 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026