CVE-2026-75886

Executive Summary

CVE-2026-75886 is a missing-authentication weakness (CWE-441, "Unintended Proxy or Intermediary") in the openshift/console component of Red Hat OpenShift Container Platform. The CatalogdHandler endpoint performs no authentication check and forwards the openshift-session-token cookie, allowing an unauthenticated remote attacker to reach the in-cluster catalogd service through the console as a relay. Successful exploitation discloses the internal operator-catalog index and grants a foothold into the openshift-catalogd namespace, with CVSS 3.1 base score 7.2 reflecting a network-reachable, scope-changing (S:C) confidentiality and integrity impact.

Technical Analysis

The vulnerability resides in the authentication and request-forwarding logic of the OpenShift web console's CatalogdHandler. Per the NVD description, two defects combine:

1. Missing authentication on the handler. CatalogdHandler "lacks proper authentication." Requests reaching this handler are not gated by any identity or session validation on the console side, so an anonymous client on the network can invoke functionality that should require an authenticated console session.

2. Cookie forwarding / unintended proxy behavior. The handler "forward[s] the openshift-session-token cookie" while proxying requests to the in-cluster catalogd service. This is the CWE-441 condition: the console acts as an intermediary between the external attacker and an internal service, and it attaches a credential-bearing cookie to the outbound request. Because catalogd sits inside the cluster and trusts traffic originating from console, the upstream service evaluates the forwarded request as if it originated from a legitimate, authenticated console user.

The combination yields two distinct effects. First, the attacker gains unauthenticated request routing into catalogd — the Cluster Catalog component that serves operator catalog index data. Second, because the openshift-session-token is attached to the forwarded request, the attacker can reach endpoints within catalogd that require a valid session, effectively borrowing the console's authority. This is why the CVSS vector carries S:C (scope change): the vulnerable component (console) is used to affect a separate security authority (the catalogd service and the openshift-catalogd namespace).

The NVD description does not enumerate the exact HTTP verb, URI path, or query parameters accepted by CatalogdHandler, nor does it specify the exact endpoints on catalogd that are reachable. It does explicitly state the outcome: "disclosure of the internal operator-catalog index" and "providing a relay into the openshift-catalogd namespace." No catalogd API paths, no console route definitions, and no source filenames are disclosed in the available data.

On the attack surface: the console is exposed over the network (AV:N) by design, the handler requires no privileges (PR:N) and no user interaction (UI:N), and no special conditions complicate the attack (AC:L). Confidentiality and integrity impacts are rated Low (C:L/I:L) and availability is rated None (A:N) — consistent with information disclosure of catalog metadata plus the ability to influence requests relayed through the proxy, rather than a full cluster compromise via this vector alone.

No affected version boundary is provided, and no patch has been published by any tracked source. The operator-catalog index is ordinarily non-secret configuration data, but it exposes the exact set and versions of operators an organization has subscribed to, which is valuable for precision targeting of downstream component vulnerabilities.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE. The attack chain below is inferred strictly from the vulnerability class described in the NVD entry; no specific function names, parameters, or endpoints beyond those appearing in the description should be assumed.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-reachable OpenShift web console. The console is a standard, well-known service; discovery can be performed with the Shodan dorks listed above or by enumerating known OpenShift console hosts during external or internal scanning. Because the flaw is in CatalogdHandler and is reachable unauthenticated, the attacker does not need valid credentials or an existing session to proceed — only reachability to the console.

2. Triggering the flaw class. The attacker crafts an HTTP request directed at the console's CatalogdHandler route. Because the handler performs no authentication check, the request is accepted from an unauthenticated client. This is the intended-proxy-abuse condition of CWE-441: the attacker interacts with the console as if it were a legitimate front end, but is never required to prove identity. The exact request syntax is not disclosed in the available data; the exploitable property is the absence of an authentication gate on the handler, not any particular payload string.

3. Credential forwarding and relay. As the handler proxies the request inward, it forwards the openshift-session-token cookie to the in-cluster catalogd service. The attacker does not need to possess this token — the console supplies it. catalogd therefore processes the request under the authority implied by the forwarded session, allowing the attacker's request to traverse into the openshift-catalogd namespace rather than being rejected at the cluster boundary.

4. Post-exploitation impact. The attacker receives responses from catalogd and can enumerate the internal operator-catalog index. This discloses which Operators, channels, and versions the environment has made available or subscribed to. The namespace-level relay also provides a reusable path for probing additional catalogd functionality through the same proxy arrangement. The CVSS subscores bound the direct outcome: information disclosure and limited integrity impact, with no availability impact attributed to this vector — this is a reconnaissance and access-primitive flaw, not a stand-alone remote code execution chain.

Because the flaw is an authentication/architecture defect rather than an input-parsing bug, exploitation is likely to be repeatable and automatable once the handler route is identified, and it leaves no requirement for victim interaction.

Impact Assessment

Business impact. The primary loss is confidentiality of the operator-catalog index — a map of the software supply chain the cluster consumes. For an enterprise, this reveals which operators, versions, and channels are deployed, enabling an adversary to prioritize secondary attacks against exactly the components present. Regulatory exposure is plausible in environments where catalog composition is treated as sensitive infrastructure metadata.

Affected systems. OpenShift Container Platform clusters running the affected openshift/console code path with a deployed catalogd service. The defect sits in the console but pivots into the openshift-catalogd namespace, so both the management plane (console) and the catalog namespace are in scope.

Blast radius and score interpretation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N yields 7.2. Network reachability, low attack complexity, no privileges, and no user interaction make the barrier to entry minimal. S:C indicates the attacker crosses a security boundary — the console's authority is abused against a separate authority (catalogd) — which is what elevates the score despite only Low confidentiality and integrity subscores. Availability is unaffected. There is no evidence of exploitation in the wild, no CISA KEV listing, no public PoC, and no EPSS score (FIRST.org has not scored this CVE); the practical risk today is latent rather than actively exploited, but the unpatched state means exposure persists until a fix or mitigation is applied.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to OpenShift Console CatalogdHandler Proxying catalogd
id: 8f2c1a44-6b17-4e0d-9c3a-2d5e7f9b1a60
status: experimental
description: Detects requests to the OpenShift console CatalogdHandler route from unauthenticated clients, and forwarding of the openshift-session-token cookie to the in-cluster catalogd service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75886
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: openshift
detection:
  selection_path:
    cs-uri-stem|contains:
      - 'CatalogdHandler'
      - 'catalogd'
  selection_cookie:
    cs(Cookie)|contains: 'openshift-session-token'
  selection_unauth:
    sc-status: 200
    cs(Cookie)|contains: 'openshift-session-token'
  condition: selection_path or selection_cookie
fields:
  - c-ip
  - cs-uri-stem
  - cs(Cookie)
  - sc-status
falsepositives:
  - Legitimate authenticated console users browsing operator catalogs
level: medium
tags:
  - attack.t1190
  - cve.2026-75886

YARA Rule

rule CVE_2026_75886_OpenShift_Console_CatalogdHandler_Abuse
{
    meta:
        description = "Detects references to CatalogdHandler and openshift-session-token forwarding indicative of CVE-2026-75886 exploitation artifacts in logs or source"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75886"
        date = "2026-01-01"
        cve = "CVE-2026-75886"

    strings:
        $handler = "CatalogdHandler" ascii nocase
        $cookie  = "openshift-session-token" ascii nocase
        $ns      = "openshift-catalogd" ascii nocase
        $svc     = "catalogd" ascii nocase

    condition:
        filesize < 5MB and
        (
            (uint16(0) == 0x3c3f or uint32(0) == 0x646f630a) and
            any of them
        ) or
        (2 of ($handler, $cookie, $ns, $svc))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75886 OpenShift Console CatalogdHandler Unauthenticated Proxy Attempt"; flow:established,to_server; http.uri; content:"CatalogdHandler"; nocase; http.cookie; content:"openshift-session-token"; nocase; classtype:attempted-recon; reference:cve,2026-75886; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75886; sid:202675886; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET" and
      wildcard(http.request.uri.path, "*CatalogdHandler*") ]
  [ network where wildcard(http.request.uri.path, "*catalogd*") and
      wildcard(http.request.headers, "*openshift-session-token*") ]

Splunk SPL Query

index=web sourcetype=openshift:console OR sourcetype=access_combined
| search (uri_path="*CatalogdHandler*" OR uri_path="*catalogd*")
| eval cookie_present=if(like(_raw,"%openshift-session-token%"),1,0)
| where cookie_present=1 AND status=200
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip uri_path status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="openshift,web,">
  <rule id="100886" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri_path">CatalogdHandler</field>
    <description>CVE-2026-75886: Access to OpenShift console CatalogdHandler route detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100887" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">catalogd</field>
    <field name="cookie">openshift-session-token</field>
    <description>CVE-2026-75886: openshift-session-token forwarded to catalogd proxy - possible exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no vendor patch, no workaround, and no affected-version boundary have been published by any tracked source. The measures below are compensating controls, not fixes.

1. Immediate mitigations.

   • Remove or restrict external network exposure of the OpenShift web console so that CatalogdHandler is not reachable by unauthenticated clients. Place the console behind an authenticated reverse proxy or VPN and restrict source ranges to administrative networks.
   • At the ingress/edge, block or return 403 for requests to the console route associated with CatalogdHandler until a patch is available, if the route can be identified without breaking legitimate console catalog viewing. Validate carefully — over-blocking can degrade console functionality.
   • Strip or refuse externally supplied openshift-session-token cookies at the perimeter proxy so attacker-controlled requests cannot ride the console's credential forwarding behavior.
   • Audit console access logs for the patterns in the Detection Guidance section and treat any unauthenticated CatalogdHandler hits as suspicious.

2. Patch/upgrade steps.

   • Monitor the Red Hat OpenShift Container Platform security advisories and the openshift/console project for an official fix. No fixed version is currently identified.
   • When a patched console image is released, update openshift/console to the fixed release and roll out the updated console pods across all clusters.
   • Because catalogd and the openshift-catalogd namespace are implicated, review catalogd deployment notes for any coordinated update.

3. Long-term hardening.

   • Enforce authentication and authorization on every console handler; treat any handler that proxies to in-cluster services as a privileged boundary and require explicit identity checks (defense against CWE-441 class defects).
   • Remove implicit credential forwarding of session tokens to backend services; if forwarding is required, scope tokens narrowly and validate that the originating request was itself authenticated.
   • Adopt network policies that prevent the console from being an arbitrary relay into cluster namespaces, and monitor east-west traffic from console to catalogd.
   • Maintain an inventory of cluster operators (the very data exposed here) so that catalog disclosure does not translate directly into an easy targeting map for adversaries.

References

• NVD — CVE-2026-75886: https://nvd.nist.gov/vuln/detail/CVE-2026-75886
• CWE-441 — Unintended Proxy or Intermediary: https://cwe.mitre.org/data/definitions/441.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Red Hat OpenShift Container Platform security advisories (monitor for catalogd/console fixes): https://access.redhat.com/security/security-updates/
• Red Hat OpenShift openshift/console source project: https://github.com/openshift/console

No threat actor campaigns, exploit-in-the-wild evidence, CISA KEV listing, or public proof-of-concept are associated with CVE-2026-75886 at the time of writing.