OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
Impact
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secret labeled osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply users[].user.exec. When rest.TransportFor builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin,…
Source excerpt · GitHub_MAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
osac-project · GitHub_M
osac-operator
1 range
osac-project · GitHub_M
osac-operator
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 7e4222b
Other versions: unknown
Original source description
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data with clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. An attacker who can create or modify a Secret labeled osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply users[].user.exec. When rest.TransportFor builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-console-proxy service account inside the pod. Attacker-controlled clusters[].server also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively local mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-62284View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-62284
Observed 2026-10-30T22:48:06.394Z · upstream updated 2026-10-30T22:15:16.751Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T21:21:11.867101Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.