RHSA-2026:24759HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.20 CNF vRAN extras topology aware lifecycle manager update

Published
June 9, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products6

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/topology-aware-lifecycle-manager-aztp-rhel9@sha256:fd651cae01a99c16e58c4936870116900f2d16f1f95d4cfae2139c271dcac80f_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:ee74e07922888fe52655c24b51644e5def85d0d4189f70b1f50e7090e05d34e7_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/topology-aware-lifecycle-manager-precache-rhel9@sha256:9b7f3a13ea10b760891ac6efafe0dd7cb4a62e0a67d2bb346138dae28897865c_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/topology-aware-lifecycle-manager-recovery-rhel9@sha256:7ac83d1018211a2ed8ed3e041b2c91b19ff3558e0127d94b325d5ec96f93532a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/topology-aware-lifecycle-manager-rhel9-operator@sha256:5748ae075ffdca0e11bf4f522c308e46554fc5f55d7758d7d1b12e9156e35105_amd64 as a component of Red Hat OpenShift Container Platform 4.20

✅ Remediation

For OpenShift Container Platform 4.20, see the following documentation for important instructions about upgrading your cluster and applying this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/index Information about accessing this content is available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)