RHSA-2026:21692HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.13.67 security and extras update

Published
June 4, 2026
Last Modified
September 24, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products39

  • Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/frr-rhel8@sha256:1d98e37af9119927c9109ce0bcfc0846dc5097724475cd238a84279f10a89e11_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel8-operator@sha256:8cf39a560a5634556cb90a0aac757f0b8e9c4659f3a40530499b83d7f12a2c1a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/metallb-rhel8-operator@sha256:ea401236f9095016e8bafd19b66822159a863651025f1c4eeb19c51c9307d141_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/metallb-rhel8@sha256:518a0fc8a9512e25d2efc450bca820d027b9c24c5179860f3306c5aa64e482a2_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ansible-operator@sha256:11cfc983202c44d7aae4374a7e943a0a3885332b992cad4489364daf0b7f2ff2_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:4a8381572ac578a7aa5c84d1bc302a13b86d17c4fbfa2c8a4e6c11b0bf18a77a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:1570690ed85daf96be33f6345e9d78bb72f1fa4afbea33a7f7948f875d075e32_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel8@sha256:e21dcb28b67252df45c0bff4d180a3c03a811516135d739552b8662fd76bdd62_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:e21dcb28b67252df45c0bff4d180a3c03a811516135d739552b8662fd76bdd62_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cluster-capacity@sha256:973e4d63c0e42ca3160f5f45478ab2361043936a7d98b861da54710fdc779dd9_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:5b6203e148957e6d4a4cc996e3ff3fbf72e49d42dbbdb9f293807babf0601f6e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:f08eed07c14665bfbf05ff3eb7a11007a03245a4623340c2b89a6df6db1998c6_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:85bb15771b64a83ece8a69a93ad039d03cdb7bc35e7d45ad927b9a34441fdaf9_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:c42a1e0af139d161af0f545e79ac8bd09c45de3bcf97675d5be294ccde5c265f_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-dns-proxy@sha256:5a457bdccd7a019189ee0f4500615daf2a38b9265b62b06386dbcab21e40142b_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:53e5e8ba9cffb0b888445a1e44e1ae076efc58e2bd51166abf881f7e09d9ddc5_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-egress-router@sha256:353d073f4e0ae23c914bafcfabbf66b78b9c86fce092602d8d1eef1e8e584209_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8-operator@sha256:31247d24fee7047d82a8e98348fff86ff1b22f6e1378687ab3408bab065cce0a_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:ee5ef59b6199d31330436a1d1cb317da5ffc16219d6b7637f0b7cfc9b94e2848_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-helm-operator@sha256:a069eef4c23f6ca775ad74ca76bd34fc67ab01bafadd92bff94942cc7faadca4_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:51eff0c396973b30abbb9e3963b621592130f764326c18cbd6e3c029b42d2b01_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:2aa837ae787dcc8b4d9cc7d1f572b5a07f58e2026c10a7d85adebcc27deea240_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:ca376f567a41c90a23a09a92bfa6685dc42e9b195e37fa4c822b593a26f93f2e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:74578bdac61ddd2c10fe95f2cb306cd004dcebbc0d1c16be653810cb011b807e_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:dfd119bd7e1078beb2e9f777cb3740bc2098886a98a4ce9f45730850199ec2fb_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-operator-sdk-rhel8@sha256:cf858b4efe51671c626bcaab7ccbdd0617b7a18c55082c63bf2d76da1790736d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ptp-operator@sha256:769e9c9e2ac6e98c26a4b99eff00fc01a3dd6b0b936d977c2a3d37be33e0f015_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-ptp@sha256:514c754827b0d5c500f480765b3f6dd9a4f92f7b15d68c5a65b7cd4115eb4c73_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • registry.redhat.io/openshift4/ose-sriov-dp-admission-controller@sha256:f7b6b4912ee70d93bfa6719c423c5c60047a388bb8f119bb99897ce35b64a06d_amd64 as a component of Red Hat OpenShift Container Platform 4.13
  • +9 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)