RHSA-2026:23235HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.15.65 security and extras update

Published
June 11, 2026
Last Modified
October 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products160

  • Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/frr-rhel9@sha256:291b51f142433087d9a68c8ebeed772e37af6a54d3254aec4546483f83194b35_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/frr-rhel9@sha256:3328a0675ae2db79afec057009561e1c262eaa358897ad8a054e180297482b62_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/frr-rhel9@sha256:4df2698aa1277101384f263e1a52932cffadf5399df1ac670e94289184950d4e_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/frr-rhel9@sha256:ae9fb26083a889158d6ebebc49c93baac3190bb7349fa172a831e0295013bb9b_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:162f41708e4582e0159ae794fec9969c35d1d1e8cf30037d45d896b7876b215b_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:5818b8345278b815cd0dab3e409606c5b14ae0da8bfc4fadfd28fe7dad8f69c5_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9b54ca053b72e45af815c08a7833d32bd89266ac0f65b7aa25d3c2a88ea107c1_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:dd4d28880ffd6f422cbc3bc82138b2ff18f075ba3e1b82d9993c648d057e645f_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:2976c8097cce2468c476a58d0ca49de48a06f90ff00c7a5546e608bd6adc02ac_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6d5cdf8de9e565ef45226f1acc743358da5c14663a93d5b427c97940eb598c59_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:89fc8976059bb5f50b3950cd7c4625d4c77b630ad784b9c29ce7544de84e611e_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:926b8d99005277c95ab7c64758cfe64316f6b94f54fed2892aeef67a44fc9df4_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:446aeff94de90603fb22af76d310aac93ebad334dcc3f6da57f56bc3e587c041_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:d6aca6e75eb464afdb001d6cb7b69c9068e82e1b1defa6dcb1f48e16392a3bd5_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f017c14d20143d1c0de3c003fb4dfc5b5256d30e2c3954e18d6544fd0f1591f8_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:fe53979d7f1454153a4ad56e7e267faf75be5e995c2a4710eadb0eab5b41be9d_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:8f567764033b088891642a5bacca1cb291d83b64cdf1e4f840d820f7d3cbe1ee_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:a10863101a9a63c08126a63150799e23b315d51268ae927fe7021c7c7ef60f27_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:a11f515530bb260d97b24371ea2e21de404b46a95b222695b8a914eb0942e0ca_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:e181e6c870125af4250b753c7836bbc1a5b4eeaf0ca24100ff2cd6636ec68a3e_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:01114ee04a38b2d63d4f4d7877cfeb45e3fd72db019ac09657e55eaef82ac3e1_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:8c978d3a39f9fbcff5973ba44c41c4c2bc459f3ab1b0fadddc1ef81f6b190072_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:b3a3458c99efac27e7db18d16fe8587b98215795c322c24d721403da5d820818_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:dee09d94717c386691d2a1cad966eccc6b4e695f9a7aaf5e831908912cd07b4c_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:17ee5262a2f32a842d902d6558c29b9297ae5b07b39eeaaae890421f32f7d653_arm64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:4ee52748f05d501ce0315ed4e5b72c0df290e2221213c5af1ac6f6666cfcb3a5_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:aa2d907596b9b5cf15e6d4f0b6edb26be0e5f09547fa869d59e525a3e64a2b95_s390x as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:bdf9948a90fe6c4f72fae0fabcb1e82aa53f25c16ace20bfa1a67ba400a53db5_ppc64le as a component of Red Hat OpenShift Container Platform 4.15
  • registry.redhat.io/openshift4/ose-ansible-operator@sha256:785bf6b208680c589939dabd27f0d67f9ff94e1dde3cac6000d63f3dc29df33a_amd64 as a component of Red Hat OpenShift Container Platform 4.15
  • +130 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)