- Severity: HIGH
- CVE: CVE-2026-62284
- Ecosystems: go
- Packages: github.com/osac-project/osac-operator
### Impact
The console-proxy’s RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec
plugin stanza (under users[].user.exec) is faithfully preserved. When rest.TransportFor later builds the HTTP transport for the upstream WebSocket connection, client-go invokes the exec plugin — spawning an
arbitrary process as the osac-console-proxy service account.
This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: “true” in a namespace where the
console-proxy has Secret read access (governed by its RoleBinding). A secondary vector exists via attacker-controlled clusters[].server, enabling server-side request forgery (SSRF) from within the proxy pod.
Affected configurations: any deployment using remote or auto VM cluster mode (the default). Deployments using local mode exclusively are not affected, as they do not read kubeconfig Secrets.
### Patches
The fix is two lines in internal/consoleproxy/config_resolver.go, applied immediately after clientcmd.RESTConfigFromKubeConfig returns:
config.ExecProvider = nil
config.AuthProvider = nil
This is patched in `0.0.4`. Users should upgrade to the first release containing this patch once available.
### Workarounds
– Restrict Secret creation in the namespace where the osac-conso…
Source: GitHub Security Advisories · 2026-11-06