RHSA-2026:25009HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.14.67 security and extras update

Published
June 17, 2026
Last Modified
October 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products159

  • Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:6684e2eeed9abc9f629cb2e3ccc2d05c408916d80db9ccc90e730435f58f8b6e_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:908e4aa53bf2b34f46088898e29b4523a33f1a548833a848c154b2c967899e33_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-event-proxy-rhel8@sha256:ab8a58b352931904265eebaa1e1abbeb903fa9e682e1ddbac56f6b88cfb00160_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/frr-rhel9@sha256:8451c790ba30fb6395d8074c37c150d88d2adad11920e9b999332ffdb929a328_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/frr-rhel9@sha256:cdf612d1d3001b7e2eab47bee66395dc626a6a41421a9fff247ac7f1e530c281_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/frr-rhel9@sha256:d6584c4860edb91594eda55fcb27a576c6e74313b10569079d5454553dc1b64e_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/frr-rhel9@sha256:e970ac1c75d936d92009f8fbc6754079704ea6d7731f2065c345c3a1e4412cdb_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:3965aaeeb958ccea911ff08d45da2c16ef953f6a473eb69b790fa1afa7c0b76d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:a7e30f2b77bb97ed583ee189ed72dfe9ad2a3928c67eb6d5aade5f1467f5d332_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:b3925f84e0f1311b6a2461b89da2d45c79d93fb87c927e8211581a320ca9f9d4_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:dfa66f12770ded49cbc84646d0c22440a157fcc71704d9162e1336a26331d9fc_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:4601d8011ff56e11bb8821db387d98354312a371bd8670cf915bfa9dd3de99be_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:59850338d772efb690f2016093b01feeb4dd3c73805d77c26172ef7f293f1a55_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:7fe48ad9f89f61203bd0ee397ccf7c5d9d37ec30b05ba837dc1089fe6ee67068_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:9cbca78a3a21d65303eba79b841fbe67f53b0a65fc82879534266075deef35d4_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:5b648181cb5f1db70ab87fbf67b017c76fc1f83f7add0eacb658bc723763e3e1_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:748bda8560c46129d59afd0680c6ce7421d5bbe007cde1e750a8dc9c417cc88e_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:776c81365d8979f2ca91127ff47d38362c7a1682643bb70d9f221a35b4c1f05c_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:e6deb824bf0fdd43b4c1d89e8b8601e05b1b09dd1b89922fbb6e3ca7ef7bdfea_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:35b685780d05bc62b306783208ceea2a99b78ec1e38099d25ab9e27fe64fc2e9_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:38b7e234acdefe69fa3c01d50447aecf4314443f72410df6b81d9b7d66d8281c_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:5cbf178c6594a373950ddf0e3c81452aa4163b6e4ebf30a735207a2523cf918a_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:93c75b2ad4a4b85855a1e63cf1e1ca7e0a7b615c771b857d9bfebb7651d18871_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:3605def86edd8ea7f97a2e46ead0764197dfb13a9b5fd00052d91e5eb7e9fafb_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:e1fa556d3b407ce1489283a4111eafad610475cbb18d17e238cd20bdc24910dd_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:e4ac1d06fcc633033dbac0db2749c09678ef71c109c1efd75ad31ecda396f721_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:edb5c32f8172251350021de785fabeb9a00a0d8250758f7857f9ea675c74f540_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:2db7e64a9345be2d431e0ba15601ee9cc8d8dfc219a757a0f7a664d521e8adda_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel8@sha256:67bc0d4e819af067717ddcf765b4d565ba2f953c65633c122577fe192a6bea0b_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +129 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)