RHSA-2026:10201HighCVSS 8.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.

Published
April 23, 2026
Last Modified
August 1, 2026

🔗 CVE IDs covered (4)

CVE-2026-27099 →CVE-2026-27100 →CVE-2026-33001 →CVE-2024-29371 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2026-27099 — org.jenkins-ci.main/jenkins-core: Jenkins: Stored Cross-site Scripting (XSS) via unescaped user-provided offline cause description CVE-2026-27100 — org.jenkins-ci.main/jenkins-core: Jenkins: Information disclosure via unauthorized access to build parameters CVE-2026-33001 — jenkins: Jenkins: Arbitrary file write and potential code execution through crafted archives

🎯 Affected products6

  • OpenShift Developer Tools and Services 4.13
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3959cf6c1b1b5e7b2c33ef49ebe1e99dfce7e10ad14ea0c948c3365249f85230_arm64 as a component of OpenShift Developer Tools and Services 4.13
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3c83e451aa4a676671e22a6c91539311d04677601978d35032bce45e10c63a39_s390x as a component of OpenShift Developer Tools and Services 4.13
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:7bff04aabb5d39075f92b8e65d2cfebc02cfd80488037685654a1e1cbf0b2056_ppc64le as a component of OpenShift Developer Tools and Services 4.13
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:ad63a7e895c432b05a4fab3357cf1a8ab8c99a1f6bc1e86abd2c67f4f1e9a872_amd64 as a component of OpenShift Developer Tools and Services 4.13
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:8b5e1f1b924de7b31a2856c84548a1369b433170205175ce65faa0d61aaae0a7_amd64 as a component of OpenShift Developer Tools and Services 4.13

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.13 upgrade to the latest. This update includes a newer OpenShift client (oc) version bundled in the image. If your Jenkins pipelines require a specific oc version, configure it explicitly using the Jenkins pipeline tools directive.

🔗 References (9)