EUVD Vulnerability Catalog

EUVD-2026-83454

Severity: CRITICAL Base Score: 9.3 CVSS Version: 3.1

Vulnerability Description

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Changed

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): None

▪ Availability Impact (A): Low

References & Advisory Links

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

redhat

EPSS Probability

Known Aliases

GHSA-hm52-6738-r26p CVE-2026-75885

Published On

2026-09-19

Last Updated

2026-09-19