Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/osac-project/osac-operator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6GoAmendedPublished

    OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

    CVE-2026-62284 · GHSA-5w5g-j6hw-6p8f

    Affected
    • Go github.com/osac-project/osac-operator < 0.0.4
    Fixed in
    0.0.4· Vendor fix available
    Issue
    Impact The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec plugin stanza (under users[].user.exec) is faithfully preserved. When rest.TransportFor later builds the HTTP transport for the upstream WebSocket connection, client-go invokes the exec plugin — spawning an arbitrary process as the osac-console-proxy service account. This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the console-proxy has Secret read access (governed by its RoleBinding). A secondary vector exists via attacker-controlled clusters[].server, enabling server-side request forgery (SSRF) from within the proxy pod. Affected configurations: any deployment using remote or auto VM cluster mode (the default).…

    Recommended action: Upgrade to 0.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →