RHSA-2026:21697HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.91 security and extras update

Published
June 4, 2026
Last Modified
October 1, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products41

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:8107b2141f076725fb04bffc2eb49f547734da8a170f82e2e7537797bdcce1ad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/frr-rhel8@sha256:b4ecc5506da6776313451f66292ada35e8f6970eafc39cf4dd6d98d0162d7ad0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel8-operator@sha256:39bfb0395706d9d1cedd3d5d1f9664de09b40d3299a0631e73ddaecca182c40f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/metallb-rhel8-operator@sha256:7ab1b0fe9d4b4193b39fb11eaf488bade57253393aa2edfe63fc2cdc450aa0ea_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/metallb-rhel8@sha256:debf1e11685378d5762f36a40efbbe45f9c56b7f8a20993148a49eeb2fca6416_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-ansible-operator@sha256:adab032158a43dca19f90adda7096353b81d2de07200ebd4f01859aa6c8134c0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel8@sha256:de1df6a5b08ebba8ed793e86feaa375c9910ac3737952de89319beb95c01715c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-rhel8-operator@sha256:99a74f130d277ca6caac8deac7e849ef7843a22eed6ff8dfaa02b02cd0dd0df4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cloud-event-proxy-rhel8@sha256:8107b2141f076725fb04bffc2eb49f547734da8a170f82e2e7537797bdcce1ad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cloud-event-proxy@sha256:8107b2141f076725fb04bffc2eb49f547734da8a170f82e2e7537797bdcce1ad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cluster-capacity@sha256:2a8765c40de1ee4aacf3b23b5f869bd4d8d268619963fd71c55d9de22f9f55d9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-cluster-nfd-operator@sha256:9a3b25466712852158dae49ad01892858232deb5fec0737b165fca0081db311f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:5a44088f77c782105e5bc52b0fc8905d8ae5710ccb6ed2380c125699f69e6024_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-clusterresourceoverride-rhel8@sha256:a490b4dad34d94814fb35d9ef30a7da9d786092a458af7f757cbd4adc7fd0253_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-contour-rhel8@sha256:01a324c06f74969299d37ac5d41f08fcc2821abb2789e56f71cb84d6a7296e24_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-csi-driver-shared-resource-mustgather-rhel8@sha256:1f8a8c421401e4b706178005c216ad78a4e4813b33b6a958eac2c62ace1135da_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-dns-proxy@sha256:fa4352a63f8dc9c59284afca0e56f2931255bb573cb444b985acbf0026842bf5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-http-proxy@sha256:4efa58c1a0c89944e692a790075716354b14f0b48c6b299f5a73ef947a455e13_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-egress-router@sha256:0055867f60033ce653901134252b9425cadc6d5d9b5bb9f91e50f1c9661b2829_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8-operator@sha256:eb7e26d6838664d694b1d367e17407ef83510f348981806516e08ff471d2f36b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:8d3220c0cacf94e3a6cb96584f84dc217906b897c8ef0fb8450de6a8bcf9bf1a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-helm-operator@sha256:75108586cbd2399cbbb3765babbb6ad90a9bfc96af4d78fda5f40aca57077911_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-kubernetes-nmstate-handler-rhel8@sha256:c1b6ab629fc17c3ba8cfa1d688769d1a61e78d15c4e2fd2919ed49e905edf50d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-diskmaker-rhel9@sha256:8463d40a14583d1f7acd9ff73e31ccdab8ff54f7a2604e099fdbde954682f21c_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-mustgather-rhel9@sha256:61d890c9baf5ca3a7812cd48a1a992f957cb62d192888e19d0e39030db8d52c7_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-local-storage-rhel9-operator@sha256:72d95303072adce41fba3b2bbcf7aa1c888bdb64dd2d38cbebc36a04cdd8c7f4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-node-feature-discovery@sha256:2f5b14f2f41d533f444d4017123d4ed46db6e7b70fcebfd2c8443a1f1c593515_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-operator-sdk-rhel8@sha256:ee1c2aaa6384f63e9299cc634df8eae99f0a5f46346ca343391018d315cce232_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-ptp-operator@sha256:52fa48425c2b972c7bf9969ac79f4a3d298ee45638d7236ca1e19863516044d3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +11 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)