RHSA-2026:21696HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.91 bug fix and security update

Published
June 4, 2026
Last Modified
September 29, 2026

🔗 CVE IDs covered (2)

CVE-2026-25679 →CVE-2026-33186 →

📋 Description

CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:1fdeeb53fee4b04446b14041e88e1c2b29fac7a5c19f0ad71f995f3a40318a81_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:8fd045d00cd452ea92d199692aee218bb574632af0725f37c30bf4dec0336915_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:2f8bebbaf30ec2895f6334d40e164e60d9e89e437b2411ad3eb4c485a23b8706_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:7051fe678bef8ea8debccf66615017ce6a6086124b3f6cd06df98074d5b9edec_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:e1dfe5c980e4f70ee70dd5c24fe9b1d6335efaeef4960c78315201955ae1f301_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:378f5c354e1ac5bc09218e55ea0e702da9c2b30f37bb979bd814131ebe58a434_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:f77eae9606aebe9122b74070da6803ddc393fd421ca420522800f7291aafb198_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:436c15569c5fbe212d042dbc754e82596cb2445f332f3cccb4eac0106679bb84_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:080029904a966858341231a9887672d50092e1e04578ff2444849f73763885ce_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:b705a16fab2fc904c0fbe222a6c231e2d4851523bc71626a29d3d3e3a0c5073f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:88eb613ca6786fbdbb5a0a7cb53727c6fe39ee0368454f1fccfd2751b204e443_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:8671118afdb7df75810ec1ca057a4f79bf0d11bfde627c7d974eb32280587ef3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:0d6e9dde5ab95ccedba48b19b7acbc4f80f293322d8d5d7836add6c007ec99f4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:a8171ad440310bd5067ef1ea4b41cb7c63dcf4ba6833ab3f48617c77fb174ab6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:75a0f83d19775b8a585764d11d451c1198f23a2ea458e91b3e835ad6886cb47b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:e6f50a3787ec4919e98f3efed5a2f37be214898d212a099fec8347b44d8c956b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:aab66f954360604cab9c154d3a1eac790ccb17c8249aed0aa36d2d40df1e5c7e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:c4a440366e612f353a6c13c234d3f0dce5f67467e2960d449bb8ea65ac6d8324_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:6db401317fcba5f7bf78d66665999ace0a4a6b4c3b63b9db2aaab41afb4c542c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:2f84c6697edb275c1c677f2e2e20b27c1ee4e5332a7033d22ced0058602117b1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:a67a08fa9c4f01112384d38f33be25ac7f1bd697634d0790e2977cddecb511cc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:4fdd933cb9da64acd56226c15ce011e46fd0090aed5b3e6315a01bf0162300d7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:147452607a8cd38093e52b2c5417ad695385b33bd3cf9a3261fb31f31c642f74_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:f5d38d22c13f1257d969db64b7d65435a2c0919fba1251ceddd4b993ab275590_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:13ea4c117bb46fb5b78ce27910cbaa8b2a7d444c41959a54ca6aeaf97416eee7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:8acd83535f7516e6a2fc73c131018a643d85e72a2a9fbbbcc4e082c805d5cc50_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:c10f6a7bae004d3f4b5e09179cc87b2cfe7b323ad0e3bb7ef03f549dd3d139a7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:d5f5879b0a0f59b59b8ce9105b823c9f711733af333931fd98719b7d9f44b2ac_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:aa9f67b9a5400f19d078b1b13cdf4d132a0071fc66e8a5c57c4e9014bb32e8c4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (5)