CVE-2026-62284: Remote Code Execution and SSRF via Unsanitized Kubeconfig in OSAC Operator

Vulnerability ID: CVE-2026-62284
CVSS Score: 8.6
Published: 2026-11-06

CVE-2026-62284 (GHSA-5w5g-j6hw-6p8f) is a code injection and server-side request forgery vulnerability in the console-proxy component of the OSAC Operator. The RemoteConfigResolver parses Kubernetes Secrets containing kubeconfig files via clientcmd.RESTConfigFromKubeConfig without sanitizing execution-related fields. An attacker with RBAC permissions to create or modify labeled Secrets in monitored namespaces can supply a malicious exec credential plugin, resulting in arbitrary command execution within the console-proxy pod.

TL;DR

The OSAC Operator console-proxy fails to strip ExecProvider and AuthProvider configurations when parsing kubeconfig files from Kubernetes Secrets. Attackers with Secret write privileges in monitored namespaces can execute arbitrary commands as the proxy service account and induce SSRF by modifying the target cluster server URL.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-62284 (GHSA-5w5g-j6hw-6p8f)
• Primary CWE: CWE-94 (Code Injection) & CWE-918 (SSRF)
• CVSS v4.0 Score: 8.6 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
• EPSS Score: 0.51% (43.35th Percentile)
• Attack Vector: Network (Authenticated Kubernetes API Secret Creation/Modification)
• Impact: Remote Code Execution as console-proxy ServiceAccount & Unpatched SSRF
• Affected Component: internal/consoleproxy/config_resolver.go (RemoteConfigResolver)
• CISA KEV Status: Not Listed

Affected Systems

• osac-operator (OpenShift Assisted Cluster / OSAC Operator)
• osac-console-proxy component running in auto or remote cluster mode
• osac-operator: < 7e4222b6ab465fc00606c8cfed980b226820cb1b (including 8220502, v0.0.1, v0.0.2, api/v0.0.1 through api/v0.0.5) (Fixed in: 7e4222b6ab465fc00606c8cfed980b226820cb1b)

Code Analysis

Commit: 7e4222b

Merge commit for PR #321: Harden kubeconfig parsing in console-proxy config resolver

File: internal/consoleproxy/config_resolver.go
@@ -84,6 +84,8 @@ func (r *RemoteConfigResolver) ResolveConfig(ctx context.Context, namespace stri
    if err != nil {
        return nil, "", fmt.Errorf("parsing kubeconfig from secret %q in namespace %q: %w", secret.Name, namespace, err)
    }
+   config.ExecProvider = nil
+   config.AuthProvider = nil
    r.logger.InfoContext(ctx, "Resolved VM cluster config from remote kubeconfig secret",
        slog.String("secret", secret.Name),
        slog.String("namespace", namespace),

Commit: 8646637

Harden kubeconfig parsing in console-proxy config resolver by stripping ExecProvider and AuthProvider from parsed rest.Config

File: internal/consoleproxy/config_resolver.go
@@ -84,6 +84,8 @@ func (r *RemoteConfigResolver) ResolveConfig(ctx context.Context, namespace stri
    if err != nil {
        return nil, "", fmt.Errorf("parsing kubeconfig from secret %q in namespace %q: %w", secret.Name, namespace, err)
    }
+   config.ExecProvider = nil
+   config.AuthProvider = nil
    r.logger.InfoContext(ctx, "Resolved VM cluster config from remote kubeconfig secret",
        slog.String("secret", secret.Name),
        slog.String("namespace", namespace),

Exploit Details

• GitHub Security Advisory & Patch Test Suite: Advisory and associated commit unit tests demonstrate crafting a Secret with users[].user.exec to trigger command execution during config resolution and transport initialization.

Mitigation Strategies

• Upgrade osac-operator to a revision containing commit 7e4222b6ab465fc00606c8cfed980b226820cb1b to strip ExecProvider and AuthProvider from parsed kubeconfigs.
• Configure the operator to run exclusively in 'local' VM cluster mode if remote cluster proxying is not required, completely bypassing Secret-based kubeconfig resolution.
• Restrict Kubernetes RBAC permissions (create, update, patch) on Secret objects in namespaces monitored by the osac-console-proxy RoleBinding.
• Implement Kubernetes Admission Controllers (such as OPA Gatekeeper or Kyverno) to block the creation of Secrets labeled 'osac.openshift.io/remote-cluster-kubeconfig: true' that contain 'exec' or 'auth-provider' fields, or point to internal/loopback server URLs.
• Deploy Kubernetes NetworkPolicies to restrict egress traffic from the osac-console-proxy pod to only explicitly authorized remote cluster API server IP ranges, mitigating the unpatched SSRF vector.

Remediation Steps:

1. Audit the cluster for any existing Secrets labeled osac.openshift.io/remote-cluster-kubeconfig=true and inspect their decoded kubeconfig data for 'exec:' or 'auth-provider:' keys.
2. Review RoleBindings and ClusterRoleBindings to identify which users or service accounts have write access to Secrets in namespaces accessible by osac-console-proxy.
3. Pull and deploy the patched osac-operator image built from commit 7e4222b6ab465fc00606c8cfed980b226820cb1b or later.
4. Verify pod logs and runtime security telemetry (e.g., Falco) for any unexpected process executions inside the console-proxy container.

References

• GitHub Security Advisory GHSA-5w5g-j6hw-6p8f
• OSAC Operator Pull Request #321
• Merge Commit 7e4222b6ab465fc00606c8cfed980b226820cb1b
• Fix Commit 86466378aa3603253dca7fa2f59a2733af0dc092
• NVD Detail for CVE-2026-62284
• CVE.org Record for CVE-2026-62284
• CVEListV5 JSON Record for CVE-2026-62284
• CISA Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK Search

Read the full report for CVE-2026-62284 on our website for more details including interactive diagrams and full exploit analysis.