Is CVE-2026-75885 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75885 being exploited in the wild.

How severe is CVE-2026-75885?

Critical severity, with a CVSS score of 9.3, published 18 September 2026.

Is there a fix for CVE-2026-75885?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75885 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75885?

Check whether you run Red Hat OpenShift Container Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75885: OpenShift console SSRF and resource exhaustion in devfile endpoints

CVE-2026-75885 · Severity: critical · CVSS 9.3 · Published 2026-09-18

OpenShift Container Platform's web console exposes API endpoints for parsing devfile configurations without authentication. An attacker can exploit this to make the console perform requests to internal cluster services (revealing sensitive data) or send large payloads that exhaust memory, taking the console offline and disrupting cluster operations.

Technologies: Red Hat OpenShift Container Platform. Vendors: Red Hat.

Quick answers

Is CVE-2026-75885 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75885 being exploited in the wild.
How severe is CVE-2026-75885?: Critical severity, with a CVSS score of 9.3, published 18 September 2026.
Which products and versions are affected?: Red Hat OpenShift Container Platform.
Is there a fix for CVE-2026-75885?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75885 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75885?: Check whether you run Red Hat OpenShift Container Platform. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `/api/devfile/` and `/api/devfile/samples/` endpoints lack authentication and accept crafted devfile payloads. Attackers can leverage this via Server-Side Request Forgery (CWE-918) to scan or access internal services, or trigger unbounded memory allocation through large requests without content-length headers, causing denial of service in the console pod.

Affected products

Red Hat OpenShift Container Platform

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.