CVE-2026-62284High· 8.6▾ TwilightOSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secret labeled osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply users[].user.exec. When rest.TransportFor builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-console-proxy service account inside the pod. Attacker-controlled clusters[].server also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively local mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.
osac-operator < 7e4222bRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2025-61916High· 7.9Spinnaker is an open source, multi-cloud continuous delivery platform
CVE-2025-66201High· 8.1LibreChat is a ChatGPT clone with additional features
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server
CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-34473Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability