{"id":"EM-20261106-WYVA","url":"https://cyber.eventmonitor.net/incident/EM-20261106-WYVA/osac-operator-vulnerability-cve-2026-62284/","type":"cve","title":"osac-operator Vulnerability (CVE-2026-62284)","subtitle":"CVE-2026-62284","subject":"CVE-2026-62284","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-06T18:12:40.000Z","firstSignal":"2026-10-30T20:17:11.727Z","lastSignal":"2026-11-06T18:12:40.000Z","updated":"2026-11-06T19:22:11.551Z","revision":1,"life":[{"status":"Born","at":"2026-11-06T18:12:40.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-06T18:12:40.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-30T20:17:11.727Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-06T18:12:40.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261106-WYVA created."}],"stages":[{"name":"Disclosed","at":"2026-10-30T20:17:11.727Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-30T20:17:11.727Z","detail":"CVSS 8.6 · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-30T20:17:11.727Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-62284 (CVSS 8.6)","text":"OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config`. An attacker who can create or modify a Secret labeled `osac.openshift.io/remote-cluster-kubeconfig`: \"true\" in a namespace where the proxy's RoleBinding grants Secret read access can supply `users[].user.exec`. When `rest.TransportFor` builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62284"},{"at":"2026-11-06T18:12:40.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-5w5g-j6hw-6p8f / CVE-2026-62284: OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy","text":"go:github.com/osac-project/osac-operator","url":"https://github.com/advisories/GHSA-5w5g-j6hw-6p8f"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-30T20:17:11.727","score":8.6,"severity":"HIGH","desc":"OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config`. An attacker who can create or modify…","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00505,"pct":0.43293,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}