# CVE-2026-75887: Red Hat OpenShift console path traversal in locale handler

Source: https://junglewise.ai/threats/cve-2026-75887-a-flaw-was-found-in-the-openshift-console-an-unauthenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-75887 · Severity: high · CVSS 7.5 · Published 2026-09-23

The OpenShift console, a web-based interface for managing containerized applications, contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive configuration and plugin files from the container filesystem. An attacker can manipulate query parameters to bypass directory restrictions and access arbitrary JSON files, potentially exposing credentials, API keys, and other sensitive data stored in the pod environment.

Technologies: [Red Hat OpenShift Container Platform](https://junglewise.ai/threats/technologies/openshift-container-platform-4-12). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-75887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75887 being exploited in the wild.

**How severe is CVE-2026-75887?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Red Hat OpenShift Container Platform <UNKNOWN>.

**Is there a fix for CVE-2026-75887?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75887 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-75887?** Check whether you run Red Hat OpenShift Container Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal flaw exists in the /locales/resource.json endpoint of the OpenShift console's internationalization (i18n) handler, where the lng and ns query parameters are not properly validated. An unauthenticated network attacker can inject path traversal sequences to read arbitrary .json files from the pod filesystem and potentially exploit registered dynamic-plugin backends, resulting in information disclosure without requiring authentication or user interaction.

## Affected products

- Red Hat OpenShift Container Platform <UNKNOWN>

## Timeline

- 2026-09-23: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-75887](https://access.redhat.com/security/cve/CVE-2026-75887)

## Related threats

- [Red Hat OpenShift Agent-Based Installation privilege escalation in CSR approval](https://junglewise.ai/threats/cve-2026-19706-during-abi-bootstrap-the-bootstrap-node-s-approve-csr-service)
- [Ansible Operator Jinja2 template injection](https://junglewise.ai/threats/cve-2026-92982-a-flaw-was-found-in-ansible-operator-plugins-a-low-privileged)
- [CRI-O sandbox state poisoning via pod annotations](https://junglewise.ai/threats/cve-2026-62146-a-trust-boundary-flaw-in-cri-o-s-sandbox-state-persistence-allows)
- [CRI-O checkpoint restore security context bypass](https://junglewise.ai/threats/cve-2026-92574-a-vulnerability-in-cri-o-checkpoint-restore-allows-a-user-who-can)
- [OpenShift console SSRF and resource exhaustion in devfile endpoints](https://junglewise.ai/threats/cve-2026-75885-a-flaw-was-found-in-the-openshift-console-unauthenticated-access)