Executive brief
A security vulnerability exists in the Red Hat Pen Drive report generator, a tool used to analyze OpenShift clusters. An attacker with administrative access to a cluster can inject malicious code into cluster settings that then runs in the browser of anyone who views the generated HTML report. This could allow an attacker to steal login sessions or sensitive information from support engineers or other administrators who review the reports.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Pen Drive report generator due to improper neutralization of input during HTML report generation (CWE-79). Cluster-sourced fields, such as ClusterVersion spec.channel and CatalogSource metadata, are rendered directly into HTML output without escaping. An attacker with cluster administrator privileges can inject arbitrary JavaScript into these objects (e.g., via 'oc patch'). When a user, such as a support engineer, opens the resulting HTML report, the payload executes in their browser context, potentially leading to session token theft or credential exfiltration. The issue was identified in version 0.1.3 and is reportedly fixed in version 1.0.0-2.
Affected products
- Red Hat Pen Drive Powered by Red Hat Lightspeed 0.1.3
Timeline
- 2026-06-23: disclosed: Reported via Red Hat Bugzilla
- 2026-06-25: advisory: NVD and Red Hat published advisory data
- 2026-06-26: other: Published date listed in advisory metadata