RHSA-2026:10211HighCVSS 8.8

Red Hat Security Advisory: Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.

Published
April 23, 2026
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2026-27100 →CVE-2026-33001 →CVE-2024-29371 →CVE-2026-27099 →

📋 Description

CVE-2024-29371 — jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression CVE-2026-27099 — org.jenkins-ci.main/jenkins-core: Jenkins: Stored Cross-site Scripting (XSS) via unescaped user-provided offline cause description CVE-2026-27100 — org.jenkins-ci.main/jenkins-core: Jenkins: Information disclosure via unauthorized access to build parameters CVE-2026-33001 — jenkins: Jenkins: Arbitrary file write and potential code execution through crafted archives

🎯 Affected products9

  • OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3959cf6c1b1b5e7b2c33ef49ebe1e99dfce7e10ad14ea0c948c3365249f85230_arm64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:3c83e451aa4a676671e22a6c91539311d04677601978d35032bce45e10c63a39_s390x as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:7bff04aabb5d39075f92b8e65d2cfebc02cfd80488037685654a1e1cbf0b2056_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-agent-base-rhel8@sha256:ad63a7e895c432b05a4fab3357cf1a8ab8c99a1f6bc1e86abd2c67f4f1e9a872_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:02c954e1692ff2ce7c85c1505fe48e65b2b21b2f368d514fca86343f4f96cd7c_ppc64le as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:5957dae25e049ae63fd5112da7436c9c1b0a6deefe5ebc6ae11b4e78c75cfe3d_amd64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:ec218eaf3b8668c6473232a695ce742b8b8dc57274ec5fc727c996df812d5aae_arm64 as a component of OpenShift Developer Tools and Services 4.14
  • registry.redhat.io/ocp-tools-4/jenkins-rhel8@sha256:fa8f511929707eed40f5d9baf9ca89dfb8d46913746f2c0e4bd97d0b02d5d2b8_s390x as a component of OpenShift Developer Tools and Services 4.14

✅ Remediation

It is recommended that existing users of Red Hat OpenShift Developer Tools - OpenShift Jenkins 4.14 upgrade to the latest. This update includes a newer OpenShift client (oc) version bundled in the image. If your Jenkins pipelines require a specific oc version, configure it explicitly using the Jenkins pipeline tools directive.

🔗 References (9)