A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace.

net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint openshift/console: openshift/console: Unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler