{"id":"CVE-2026-83589","aliases":[],"cve":{"records":[{"id":"CVE-2026-83589","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-31T19:18:43.003Z","published":"2026-10-01T09:17:43.584Z","modified":"2026-10-30T04:25:38.534Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-10-30T04:25:38.534Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-01T16:11:53.072Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:74380","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:74383","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:74429","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:79039","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:79169","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:82785","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:82813","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89715","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:90274","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-83589","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2518379","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-601","description":"URL Redirection to Untrusted Site ('Open Redirect')","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-01T16:11:43.615229Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Oauth-proxy: open redirect via /\\ and /\\t bypass in post-login redirect","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.","score":6.1,"severity":"medium","published":"2026-10-01T09:17:43.584Z","modified":"2026-10-30T04:25:38.534Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.12","platforms":[],"versions":[{"version":"1792974337","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.14","platforms":[],"versions":[{"version":"1791837363","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.15","platforms":[],"versions":[{"version":"1791632336","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.16","platforms":[],"versions":[{"version":"1792878232","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.18","platforms":[],"versions":[{"version":"1790882320","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.19","platforms":[],"versions":[{"version":"1790807096","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.20","platforms":[],"versions":[{"version":"1790704224","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.21","platforms":[],"versions":[{"version":"1790706478","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.22","platforms":[],"versions":[{"version":"1790724885","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"}],"remediation":[{"text":"Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"}],"references":["https://access.redhat.com/errata/RHSA-2026:74380","https://access.redhat.com/errata/RHSA-2026:74383","https://access.redhat.com/errata/RHSA-2026:74429","https://access.redhat.com/errata/RHSA-2026:79039","https://access.redhat.com/errata/RHSA-2026:79169","https://access.redhat.com/errata/RHSA-2026:82785","https://access.redhat.com/errata/RHSA-2026:82813","https://access.redhat.com/errata/RHSA-2026:89715","https://access.redhat.com/errata/RHSA-2026:90274","https://access.redhat.com/security/cve/CVE-2026-83589","https://bugzilla.redhat.com/show_bug.cgi?id=2518379"],"sources":[{"name":"CVE","id":"CVE-2026-83589","modified":"2026-10-30T04:25:38.534Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"sourceAffected":[],"observedAt":"2026-10-30T04:31:40.059Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:45:31.953Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T04:35:32.764Z","attemptedAt":"2026-10-30T04:35:32.764Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T04:35:32.739Z","attemptedAt":"2026-10-30T04:35:32.739Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T04:35:33.083Z","attemptedAt":"2026-10-30T04:35:33.083Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T04:35:32.057Z","attemptedAt":"2026-10-30T04:35:32.057Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-83589","url":"https://www.first.org/epss/","probability":0.00282,"percentile":0.20753,"date":"2026-10-29","checkedAt":"2026-10-30T04:35:32.057Z"},{"source":"GitHub Advisory Database","id":"GHSA-8c7h-7vm9-jhj3","url":"https://github.com/advisories/GHSA-8c7h-7vm9-jhj3","modified":"2026-10-29T18:30:27Z","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-30T04:35:32.739Z"},{"source":"NVD","id":"CVE-2026-83589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83589","modified":"2026-10-29T18:17:35.367","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-30T04:35:32.764Z"},{"source":"ENISA EUVD","id":"EUVD-2026-90589","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90589","modified":"Oct 29, 2026, 5:14:54 PM","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","checkedAt":"2026-10-30T04:35:33.083Z"}],"aiSummary":{"text":"Oauth-proxy has an open redirect vulnerability via a specially crafted link, potentially leading to phishing attacks or credential theft. A remote attacker can exploit this by enticing a user to follow the link after authenticating. The affected product is Red Hat OpenShift Container Platform, but the exact affected versions are unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:42:49.266Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-83589"}]}}