{"id":"CVE-2026-62284","aliases":["GHSA-5w5g-j6hw-6p8f"],"url":"https://o3.security/vulnerability/CVE-2026-62284","summary":"OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy","details":"### Impact\n\n The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec\n  plugin stanza (under users[].user.exec) is faithfully preserved. When rest.TransportFor later builds the HTTP transport for the upstream WebSocket connection, client-go invokes the exec plugin — spawning an\n  arbitrary process as the osac-console-proxy service account.\n\n  This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: \"true\" in a namespace where the\n  console-proxy has Secret read access (governed by its RoleBinding). A secondary vector exists via attacker-controlled clusters[].server, enabling server-side request forgery (SSRF) from within the proxy pod.\n\n  Affected configurations: any deployment using remote or auto VM cluster mode (the default). Deployments using local mode exclusively are not affected, as they do not read kubeconfig Secrets.\n\n### Patches\n\n\n  The fix is two lines in internal/consoleproxy/config_resolver.go, applied immediately after clientcmd.RESTConfigFromKubeConfig returns:\n\n  config.ExecProvider = nil\n  config.AuthProvider = nil\n\n  This is patched in `0.0.4`. Users should upgrade to the first release containing this patch once available.\n\n### Workarounds\n\n  - Restrict Secret creation in the namespace where the osac-console-proxy-secret-reader RoleBinding is deployed. Ensure only trusted principals (cluster admins, operator service accounts) can create or modify\n  Secrets there.\n  - Switch to local VM cluster mode (--vm-cluster-mode=local) if the KubeVirt VMs run on the same cluster as the proxy. This bypasses the Secret-based kubeconfig lookup entirely.\n  - Use an admission webhook or OPA policy to reject Secrets containing exec: or auth-provider: stanzas in the kubeconfig data within the affected namespace.","published":"2026-10-30T19:23:39.257Z","modified":"2026-11-04T02:30:25.484155817Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/osac-project/osac-operator","fixedVersion":"0.0.4"}],"fix":{"url":"https://github.com/osac-project/osac-operator/commit/7e4222b6ab465fc00606c8cfed980b226820cb1b","label":"osac-project/osac-operator@7e4222b"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62284.json"},{"type":"ADVISORY","url":"https://github.com/osac-project/osac-operator/security/advisories/GHSA-5w5g-j6hw-6p8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62284"},{"type":"FIX","url":"https://github.com/osac-project/osac-operator/commit/7e4222b6ab465fc00606c8cfed980b226820cb1b"},{"type":"FIX","url":"https://github.com/osac-project/osac-operator/commit/86466378aa3603253dca7fa2f59a2733af0dc092"},{"type":"FIX","url":"https://github.com/osac-project/osac-operator/pull/321"},{"type":"PACKAGE","url":"https://github.com/osac-project/osac-operator"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T02:30:25.484155817Z"}}