CVE-2026-50237

This vulnerability exposes a design flaw in how the console's privileged network identity interacts with tenant-supplied chart repository URLs. The core issue isn't simply SSRF — it's that the Helm catalog proxy architecture creates a structural bypass where a tenant can control what URL the console fetches, but cannot control the egress context of that fetch. The console's privileged identity becomes the attacker's egress vector, bypassing tenant-level network controls entirely. The supply chain dimension is what elevates this beyond a standard SSRF. A malicious ProjectHelmChartRepository doesn't just compromise the tenant who created it — it poisons a resource that persists across the cluster's lifecycle. The privilege escalation requires an admin to install the poisoned chart, meaning the attack is latent until that mediated action occurs. This temporal gap between compromise and exploitation is characteristic of supply chain flaws: defenders won't have obvious detection signals until the malicious chart is already installed. What makes remediation complex: the patch fixes code behavior, not data state. Every affected cluster has existing ProjectHelmChartRepository objects — some planted maliciously, some benign defaults, some from forgotten tenants. Deploying the patch doesn't eliminate the attack surface; it only closes the fetch mechanism. The correct remediation requires auditing every ProjectHelmChartRepository in every namespace and treating them as potentially adversarial inputs. This is a fundamental principle for multi-tenant systems where one tenant's configuration drives privileged component behavior. The CVSS of 7.4 appears to underweight the supply chain component. The temporal gap between poisoning and exploitation means the attack surface doesn't close just because an admin 'can' prevent it — it widens because every future admin inherits the poisoned state. Organizations should examine whether audit controls exist for ProjectHelmChartRepository resources and whether they receive the same review rigor as other privileged objects.

Reviewed through automated stages and approved by a human before publication.