Description
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
References
- RHSA-2026:70587 vendor-advisory
- RHSA-2026:70617 vendor-advisory
- RHSA-2026:70647 vendor-advisory
- RHSA-2026:71447 vendor-advisory
- RHSA-2026:71450 vendor-advisory
- RHSA-2026:71453 vendor-advisory
- RHSA-2026:71454 vendor-advisory
- RHSA-2026:73853 vendor-advisory
- RHSA-2026:73869 vendor-advisory
- RHSA-2026:77321 vendor-advisory
- RHSA-2026:82813 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-75887 vdb-entry
- RHBZ#2517889 issue-tracking