CVE-2026-75887

Executive Summary

CVE-2026-75887 is a path traversal vulnerability (CWE-22) in the OpenShift console affecting the /locales/resource.json endpoint. An unauthenticated, remote attacker can manipulate the lng and ns query parameters to read sensitive *.json files from the pod filesystem, including plugin manifests and configuration files. The flaw carries a CVSS v3.1 base score of 7.5 (High), reflecting a network-reachable, low-complexity attack that requires no privileges or user interaction and results in high confidentiality impact with no integrity or availability impact.

Technical Analysis

The vulnerability resides in the OpenShift console's localization resource endpoint /locales/resource.json. This endpoint is designed to serve language-specific resource bundles (translation strings) to the console front-end. It accepts query parameters named lng (language/locale selector) and ns (namespace selector) that are used to locate and return the correct JSON resource file from disk.

The core defect is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, "Path Traversal"). The application fails to properly canonicalize and validate attacker-supplied input before using it to construct a filesystem path to a *.json resource file. By injecting traversal sequences, an unauthenticated attacker can escape the intended locales directory and cause the server to return arbitrary .json files reachable from the pod's filesystem context.

Two distinct impacts are described by the CNA:

1. Local file disclosure. The traversal allows reading sensitive *.json files from the pod filesystem, explicitly including plugin manifests and configuration files. Because the endpoint serves the content directly back to the requester, this becomes an information-disclosure primitive rather than a blind read.

2. Traversal against registered dynamic-plugin backends. The flaw can additionally be leveraged to perform path traversal against backends registered as dynamic plugins. This indicates that attacker-controlled path segments can propagate through the console's dynamic-plugin proxy/routing layer to backend services, broadening the reach of the traversal beyond the console pod itself.

Attack surface characteristics:

• Unauthenticated: No credentials or session tokens are needed (PR:N in the CVSS vector), meaning the endpoint is reachable pre-authentication.
• Network-exposed: AV:N confirms the endpoint is reachable over the network, consistent with a web console exposed via an OpenShift route or ingress.
• Low complexity: AC:L indicates no special race conditions, memory grooming, or unusual preconditions are required.
• Confidentiality-only impact: C:H, I:N, A:N — success yields disclosure of file contents but does not directly permit modification or denial of service through this flaw.

No affected version range has been published by the tracked sources, and the description does not specify vulnerable code-level identifiers beyond the endpoint and parameters named above. No function names, class names, or internal file paths beyond those in the CNA description should be inferred.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-22 path traversal via query parameters) and the specifics named in the NVD description.

1) Reconnaissance / target identification. The attacker identifies an internet- or network-reachable OpenShift console by locating the /locales/resource.json endpoint. This is a component of the console's localization asset tree and can be enumerated with standard web probing. Because the flaw is unauthenticated, no login flow needs to be completed — the resource endpoint is queried directly.

2) Triggering the flaw. The attacker sends an HTTP request to /locales/resource.json and manipulates the lng and/or ns query parameters. Instead of supplying a legitimate locale or namespace value, the attacker supplies values containing traversal sequences so that the server resolves a path outside the intended locales directory. The server then attempts to load and return the referenced *.json file.

3) Payload / execution method. This is a read-only file disclosure. There is no code execution step at the vulnerability class level; the "payload" is the crafted query parameter value that alters the resolved path. The endpoint returns the contents of the targeted *.json file to the attacker in the HTTP response. Repeated requests with varied parameter values allow enumeration of different JSON files.

4) Post-exploitation impact. Successful traversal yields disclosure of *.json content from the pod filesystem — explicitly plugin manifests and configuration files. These artifacts can reveal plugin registrations, backend endpoints, configuration structure, and potentially secrets or tokens stored in JSON configuration. The additional ability to reach registered dynamic-plugin backends via path traversal can expose backend-reachable JSON resources, expanding the reconnaissance value of the disclosure. Disclosed material is then used to inform follow-on attacks (e.g., targeting dynamic plugin backends or discovering additional endpoints). No public exploit code, Nuclei template, or in-the-wild exploitation has been observed as of this report.

Impact Assessment

CVE-2026-75887 is rated High with a CVSS v3.1 base score of 7.5. Subscore interpretation:

• AV:N (Network): Exploitable remotely; no local or adjacent access required.
• AC:L (Low): No specialized conditions; reliably repeatable.
• PR:N (None): The attacker does not need to authenticate, which sharply widens the population of potential attackers (any host that can reach the console).
• UI:N (None): No victim interaction is required.
• S:U (Unchanged): Impact is confined to the vulnerable console component's security scope.
• C:H / I:N / A:N: Primary impact is high confidentiality loss through file disclosure; no direct integrity or availability impact from this flaw.

Business impact. OpenShift is an enterprise Kubernetes platform, and the console is the primary management interface. Disclosure of plugin manifests and configuration files can expose the internal topology of the cluster's console extensions, backend service addresses, and configuration structure. Because the flaw is unauthenticated, it can be exercised by any party with network reachability to the console, making it an attractive reconnaissance primitive before lateral movement or exploitation of the exposed dynamic-plugin backends.

Blast radius. Limited to the confidentiality of JSON resources reachable from the console pod's filesystem, plus any registered dynamic-plugin backend reachable via the traversal. There is no evidence of integrity or availability impact from this CVE alone. The absence of a published affected-version range means defenders should treat console deployments as potentially affected until a vendor patch is available.

Detection Guidance

Sigma Rule

title: OpenShift Console Path Traversal via /locales/resource.json Parameters
id: 5f2b9c1e-8a4d-4e7b-9c3f-2d6a1b7e4f80
status: experimental
description: Detects HTTP requests to the OpenShift console locales resource endpoint containing path traversal sequences in the lng or ns query parameters.
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/locales/resource.json'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%2F'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '....//'
  condition: selection_endpoint and selection_traversal
falsepositives:
  - Legitimate localization tooling that normalizes paths (uncommon)
level: high
tags:
  - attack.t1190
  - cve.2026-75887

YARA Rule

rule CVE_2026_75887_OpenShift_Console_Traversal
{
    meta:
        description = "Detects path traversal attempts against the OpenShift console /locales/resource.json endpoint in web logs or PCAP payloads"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-75887"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75887"

    strings:
        $endpoint = "/locales/resource.json"
        $p_lng    = "lng="
        $p_ns     = "ns="
        $t1       = "../"
        $t2       = "..%2f"
        $t3       = "..%2F"
        $t4       = "%2e%2e%2f"
        $t5       = "....//"

    condition:
        $endpoint and
        ( $p_lng or $p_ns ) and
        any of ( $t* )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75887 OpenShift Console Path Traversal via locales resource.json"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/locales/resource.json"; http.uri; content:"lng="; nocase; http.uri; content:".."; within:64; reference:cve,2026-75887; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-75887; classtype:attempted-recon; sid:202675887; rev:1;)

alert http any any -> any any (msg:"CVE-2026-75887 OpenShift Console Path Traversal via locales resource.json (ns)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/locales/resource.json"; http.uri; content:"ns="; nocase; http.uri; content:".."; within:64; reference:cve,2026-75887; classtype:attempted-recon; sid:202675888; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and url.path == "/locales/resource.json" and
      (url.query contains "lng=" or url.query contains "ns=") ]
  [ network where network.protocol == "http" and url.path == "/locales/resource.json" and
      (url.query contains "../" or url.query contains "..%2f" or url.query contains "..%2F" or url.query contains "%2e%2e%2f") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=lower(coalesce(uri, cs_uri_stem, url))
| eval query=lower(coalesce(uri_query, cs_uri_query, url_query))
| where match(uri, "/locales/resource\.json$")
| where (like(query, "%lng=%") OR like(query, "%ns=%"))
    AND (like(query, "%../%") OR like(query, "%..%2f%") OR like(query, "%..%2F%")
         OR like(query, "%2e%2e%2f%") OR like(query, "%....//%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(query) as traversal_queries by src_ip, uri
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-75887,">
  <rule id="100887" level="10">
    <if_sid>31100</if_sid>
    <id>^31103$|^31108$</id>
    <url>locales/resource.json</url>
    <description>CVE-2026-75887: OpenShift console path traversal attempt against /locales/resource.json (lng/ns parameters)</description>
    <options>alert_by_email</options>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.t1190,pci_dss_6.5.1,</group>
  </rule>

  <rule id="100888" level="12">
    <if_sid>100887</if_sid>
    <match>../|..%2f|..%2F|%2e%2e%2f|%2e%2e/|....//</match>
    <description>CVE-2026-75887: Confirmed path traversal payload in OpenShift /locales/resource.json request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source, no vendor fix is documented, no workaround is published, and no affected version range is available. Defenders cannot rely on a version-specific upgrade at this time and should treat this as an unpatched vulnerability pending vendor action.

1) Immediate mitigations.

• Restrict network exposure of the OpenShift console. Place the console behind authenticated reverse proxies, VPN, or zero-trust access gateways so the /locales/resource.json endpoint is not reachable by unauthenticated parties. The CVSS vector (PR:N, AV:N) confirms that removing unauthenticated network reachability removes the primary exposure.
• Apply WAF/reverse-proxy rules that reject requests to /locales/resource.json whose lng or ns parameters contain traversal sequences (../, encoded variants, and similar parent-directory references). A positive-allowlist approach — permitting only known locale and namespace values — is preferred over blacklisting.
• Block or tightly control dynamic-plugin backend reachability so that even if traversal succeeds, backend-relative traversal cannot extend to additional services.
• Monitor and alert on the detection rules in this report; treat any hits as potential reconnaissance.

2) Patch / upgrade steps.

• No vendor patch is currently identified (patch confidence 0/4). Monitor the Red Hat / OpenShift security advisories and the NVD entry for CVE-2026-75887 for a fixed release.
• Once a fixed console image is published, upgrade the OpenShift console component to the patched version and restart console pods. Validate the fix by confirming that traversal-encoded requests to /locales/resource.json are rejected.
• Until a patch exists, apply the compensating controls in section 1 as the primary risk reduction.

3) Long-term hardening.

• Enforce strict path canonicalization and allowlisting for any endpoint that maps user input to filesystem paths; never concatenate user input directly into paths.
• Adopt defense-in-depth for the console: require authentication for all console endpoints where feasible and minimize the attack surface of pre-auth assets such as localization resources.
• Review registered dynamic plugins and dynamic-plugin backends for their own path-handling correctness, since this CVE demonstrates that console-side traversal can propagate to plugin backends.
• Maintain continuous vulnerability scanning and subscribe to OpenShift security bulletins to reduce mean time to patch once a fix is released.

References

• NVD — CVE-2026-75887: https://nvd.nist.gov/vuln/detail/CVE-2026-75887
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Red Hat Product Security / OpenShift Security Advisories (monitor for CVE-2026-75887 fix): https://access.redhat.com/security/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-75887 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence was identified in the tracked sources for CVE-2026-75887 at the time of writing. No EPSS score has been published by FIRST.org. No threat-actor campaign has been attributed to this CVE.