{"schema_version":"1.9.2","id":"GHSA-5w5g-j6hw-6p8f","published":"2026-11-06T18:12:40Z","modified":"2026-11-06T18:30:03.787783747Z","aliases":["CVE-2026-62284"],"summary":"OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy","details":"### Impact\n\n The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec\n  plugin stanza (under users[].user.exec) is faithfully preserved. When rest.TransportFor later builds the HTTP transport for the upstream WebSocket connection, client-go invokes the exec plugin — spawning an\n  arbitrary process as the osac-console-proxy service account.\n\n  This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: \"true\" in a namespace where the\n  console-proxy has Secret read access (governed by its RoleBinding). A secondary vector exists via attacker-controlled clusters[].server, enabling server-side request forgery (SSRF) from within the proxy pod.\n\n  Affected configurations: any deployment using remote or auto VM cluster mode (the default). Deployments using local mode exclusively are not affected, as they do not read kubeconfig Secrets.\n\n### Patches\n\n\n  The fix is two lines in internal/consoleproxy/config_resolver.go, applied immediately after clientcmd.RESTConfigFromKubeConfig returns:\n\n  config.ExecProvider = nil\n  config.AuthProvider = nil\n\n  This is patched in `0.0.4`. Users should upgrade to the first release containing this patch once available.\n\n### Workarounds\n\n  - Restrict Secret creation in the namespace where the osac-console-proxy-secret-reader RoleBinding is deployed. Ensure only trusted principals (cluster admins, operator service accounts) can create or modify\n  Secrets there.\n  - Switch to local VM cluster mode (--vm-cluster-mode=local) if the KubeVirt VMs run on the same cluster as the proxy. This bypasses the Secret-based kubeconfig lookup entirely.\n  - Use an admission webhook or OPA policy to reject Secrets containing exec: or auth-provider: stanzas in the kubeconfig data within the affected namespace.","affected":[{"package":{"name":"github.com/osac-project/osac-operator","ecosystem":"Go","purl":"pkg:golang/github.com/osac-project/osac-operator"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-5w5g-j6hw-6p8f/GHSA-5w5g-j6hw-6p8f.json"}}],"references":[{"type":"WEB","url":"https://github.com/osac-project/osac-operator/security/advisories/GHSA-5w5g-j6hw-6p8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62284"},{"type":"WEB","url":"https://github.com/osac-project/osac-operator/pull/321"},{"type":"WEB","url":"https://github.com/osac-project/osac-operator/commit/7e4222b6ab465fc00606c8cfed980b226820cb1b"},{"type":"WEB","url":"https://github.com/osac-project/osac-operator/commit/86466378aa3603253dca7fa2f59a2733af0dc092"},{"type":"PACKAGE","url":"https://github.com/osac-project/osac-operator"}],"database_specific":{"cwe_ids":["CWE-94"],"github_reviewed":true,"github_reviewed_at":"2026-11-06T18:12:40Z","nvd_published_at":"2026-10-30T20:17:11Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}