CVE-2026-62284

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

Workarounds

• Restrict Secret creation in the namespace where the osac-console-proxy-secret-reader RoleBinding is deployed. Ensure only trusted principals (cluster admins, operator service accounts) can create or modify
  Secrets there.
  • Switch to local VM cluster mode (--vm-cluster-mode=local) if the KubeVirt VMs run on the same cluster as the proxy. This bypasses the Secret-based kubeconfig lookup entirely.
  • Use an admission webhook or OPA policy to reject Secrets containing exec: or auth-provider: stanzas in the kubeconfig data within the affected namespace.

The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec
plugin stanza (under users[].user.exec) is faithfully preserved. When rest.TransportFor later builds the HTTP transport for the upstream WebSocket connection, client-go invokes the exec plugin, spawning an
arbitrary process as the osac-console-proxy service account.

This allows remote code execution inside the console-proxy pod for any principal that can create or modify a Secret with the label osac.openshift.io/remote-cluster-kubeconfig: "true" in a namespace where the
console-proxy has Secret read access (governed by its RoleBinding). A secondary vector exists via attacker-controlled clusters[].server, enabling server-side request forgery (SSRF) from within the proxy pod.

Affected configurations: any deployment using remote or auto VM cluster mode (the default). Deployments using local mode exclusively are not affected, as they do not read kubeconfig Secrets.

Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.

Kodem intelligence

Already deployed Kodem?

The fix is two lines in internal/consoleproxy/config_resolver.go, applied immediately after clientcmd.RESTConfigFromKubeConfig returns:

config.ExecProvider = nil
config.AuthProvider = nil

This is patched in 0.0.4. Users should upgrade to the first release containing this patch once available.

1. What is CVE-2026-62284? CVE-2026-62284 is a high-severity code injection vulnerability in github.com/osac-project/osac-operator (go), affecting versions < 0.0.4. It is fixed in 0.0.4. Untrusted input is evaluated as executable code within the application's runtime environment.
2. Which versions of github.com/osac-project/osac-operator are affected by CVE-2026-62284? github.com/osac-project/osac-operator (go) versions < 0.0.4 is affected.
3. Is there a fix for CVE-2026-62284? Yes. CVE-2026-62284 is fixed in 0.0.4. Upgrade to this version or later.
4. Is CVE-2026-62284 exploitable, and should I be worried? Whether CVE-2026-62284 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-62284 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-62284? Upgrade github.com/osac-project/osac-operator to 0.0.4 or later.