CVE-2026-42965: Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

Synopsis

A server-side request forgery (SSRF) flaw in the OpenShift Router lets a user with EndpointSlice write access create a Service backed by an FQDN-typed EndpointSlice that resolves to a cloud metadata endpoint. Because the router validated IP addresses but not FQDN-resolved destinations, requests get proxied to the cloud provider's metadata service over the network. Successful exploitation discloses instance credentials and other sensitive cloud metadata. HarborGuard tracks the Red Hat advisory and will make a patched rebuild available when an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OpenShift Router over the network to trigger the proxied request.

• AuthenticationRequired

  A low-privilege account with EndpointSlice write access in the cluster is required to plant the malicious FQDN-backed Service.

• Victim interactionNot required

  No user action is needed; the router proxies the crafted request on its own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable once the EndpointSlice is in place and does not depend on race conditions or memory layout.

Blast Radius

• Reads cloud instance metadata served by the provider's metadata endpoint, including temporary IAM credentials bound to the node.
• Discloses other sensitive metadata such as user-data, instance identity documents, and cloud configuration that can seed further attacks against the cloud account.
• No direct integrity or availability impact on the router itself, but stolen credentials can be reused outside the cluster to pivot into the underlying cloud environment.