RHSA-2026:23247HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.19.33 security and extras update

Published
June 10, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products186

  • Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:114ef923113d96b60db2dc2387fa3bc1a0549eb6d0ae4cdaf9ea8982f4285318_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:3d167008ccf6f63d957b0882236b91026bbd5d24ebcc8d86064dbfd8adbee92e_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:e37d0d4163fe1457d80d61b3e2d12688a7be8ed0ac80b541512e012e8d2e24e5_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:ea44f914f208c07cd12e532f20d7dcb75920d48b666e74e04d571263f2ce116a_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:1c3674f71c4b67865c3ca7887afe31bd920b4f9b1d7b9b4d8821e86fcd1cf683_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:1e19eafa7ac35dab19ec4f1ea574e1b30d8745612291fa17d5106e8c33107cc0_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:3a5e292104de60e27933c0c5f4a31eb6cb5b6e8dd1798322c82bb9eafb66b5bd_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:6ade312a63c3bfedd24b4c28c41c367976447e8e339b409278b85d0a6fecab2f_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:5747333958f5c0fb29f895213eb949e5349523e8246e47892677f73b933cd98c_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:5aa3196510e54fe6c8d7f18051a54277d95a6a4aaafa4fce418906d19376473f_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:c129d71da1ab488e87735c6dac89f45105b25874e214b87a190c1463545c0698_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:d3793610be59df42532d7fffacec4cfb5d4db727cfdb3adbec246c8291acee73_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:1cc46e949b1b62497fade1bc0f70ba3c31897f0852a0bd624d646f77467865f7_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:607def146433e715e5a2df2937f98a2fc846c62fa141544623e2f0505b54f509_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:7ee76b9716737a2e468f8c7adc13219ce1b1935db7807934c4fe991041d86bbf_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:e6376e4589e439fd425fe4e994282f3cf430c88270e22bade5ab37c0b16a8538_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:3b60b56e833a8ddba21fb801e9842393cb8d9c8490860a70d7fa84ee78a3f4a9_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:6d655b10e00e22ab5c838154688a2847d8eb03c5349fa20ea3577c3d3a594f6c_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:b19b7c39f18d13ca2b54d5309e5862e2add9daf78a708e2797e440e162410752_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:bf60500c40f536a4b7d81cd68e205c3d0dbe0a7929e57157aa986704ce3fa829_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:085eaba935de5205cbf93d2565d95c604fd47953fd633f0e6dff09e2b5a6b5cb_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:57a27f485283135ea1ab5859d8a0217069c2353af1c21fc245bc7e926319b940_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:d8198f09a7ef3689b3a0762be6d29cf8cbb7d26a308982e5eb754c171e9ca6df_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:d938a83b34fbaef6b1ab61e85dd8c36bb19f9591bbd042c95353691b75954e4f_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:144ccbf16668bcb6d96b8975b52dea9d92b9a9dcabf21813afdebbf9186dbcb4_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:250522cc8b989d6a9ee1658e0b52333f83f969b6b527a0fcab58495e8fed6b85_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d2b4b1927af8eeb63f3f6a4df7954e6a7c58b570ce4cdef02e9eddc3b18534a8_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d6f4005c71765d0158b613b7739abae3f9926ab2fd8f1841b073ce17f73971e2_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:0e3f11dc6f035a33d0c3c97d4865713ea3bcc9fd547ffe8e2d6d9d64d0d9b3f6_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • +156 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)