CVE-2026-62284 Details

A remote code execution vulnerability has been identified in the OSAC operator for Kubernetes, specifically in the console-proxy component's RemoteConfigResolver. This issue arises in the affected revision 8220502, where the resolver improperly parses kubeconfig data from Kubernetes Secrets. The parsing is done using clientcmd.RESTConfigFromKubeConfig' without sanitizing the resulting rest.Config. An attacker with the ability to create or modify a Secret labeled 'osac.openshift.io/remote-cluster-kubeconfig: true' in a namespace with the proxy's RoleBinding granting read access to Secrets can exploit this vulnerability. The attacker can inject exec credentials that, when the HTTP transport for a WebSocket connection is established, trigger the execution of arbitrary processes as the 'osac-console-proxy' service account within the pod. Additionally, manipulation of the 'clusters[].server' field could facilitate server-side request forgery from the proxy pod. This vulnerability affects deployments in remote and auto VM cluster modes, with local mode remaining unaffected.

Users should upgrade to the first release that includes the patch for this vulnerability, which is available in the GitHub repository. Additionally, it is recommended to restrict the creation of Secrets in namespaces where the OSAC console-proxy has read access, ensuring that only trusted principals can modify Secrets. As an alternative, switch to local VM cluster mode if KubeVirt VMs are running on the same cluster as the proxy, or use an admission webhook or OPA policy to reject Secrets with exec or auth-provider stanzas in the kubeconfig data.