RHSA-2026:25046HighCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.16.64 security and extras update

Published
June 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products188

  • Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/frr-rhel9@sha256:389f66df4c94833b678a6125b639a71ac5224d0aea660a8e1b09da1642212b56_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/frr-rhel9@sha256:526562985eca24dd24aef4bc594e3fd4cd0f1251679c1c5a58028c7bf5ef70e3_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/frr-rhel9@sha256:abc42265a96b6ec9245da91b62571b68b7daa0a59dc891d5f6c3ab31b30ce9cd_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/frr-rhel9@sha256:caf6ba5b2de7096b87f6d0bf9876791e9fc22835898634133cc984b3cfcbce89_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:22443413894b8202cc13349a7039bc0d303fefe7c2a752bdfbd26b5e6c285b6d_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:36061d16a4211f444c84c4239942de5204f1654703040a431cef361ee49ef985_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:8562201db29012ed85e9fefaca5bc282454a6f748251ee602ee62bd42de86f0b_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:98b13c6f331a411be5ccc3b15e23376b97ceca931e28d826f103ca6fb869f597_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:0ab84f3af21c0f4a9377011d086e9bcca8fcada8fe10876a0f2e0709c05eb836_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:1c34a2d511cb011d4a2d68882e813f00bddf7b440ef76110f65511d629c09651_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:63934f421a8c4e798384196b0eb5e03e16392b5a951be5e1febe9ce254846314_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:d8d4218960a9f0eaaf673ae8ac6ba1e2fffb8b91a76beb2e78cb5d5d04dd34ea_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:388c932a488fd665b1687c3f27fd32fe4e623d54cf10ee269c6617863d81f7f9_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:7e04c52aa14d9f65e71c11ef6a46f366c0825080364299299f9cb15363fbada3_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:96728e5dde6e4ef336cfe343db9327accc466201be2161029fb772b718ccf867_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:cb23ee7f27e297d2ab0b6c308e49a1e60e409ed223193bc95553d00897f733e6_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:1a1dd88c6bff209788c45467d1e94998ba2bd6fa181d570389ee120eb867db5c_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:1b08bf1976b5e5abd1489f9a9f3197c48551f78dfbf4298797aef9e963c0cc2d_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:65da29ddee348a377d4058862795ed742f3a9579a702604d6f03ac507d277516_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:70888930960f555c3306dd3ca50c54191784e66dd10073f775f468e5b30aa427_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:32e4cc3a06048b9548ba77856624294e2e52cfb46118da8330b09cdd7551b9d7_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:3dde89c7fe9ffa2a691bd425dc32dd3b2ed0096ebabedfe8b7cd7d58a35c3818_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:447deed2bfa2d9474405115716f44905c5cb65d95a7f299c7ce496cb4a3c7579_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:65b21face4ebf60f2eeb98086e9da2298fa4faac44867c0a7a42deb009afa4b5_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:0ce089ab0fb0bbbb84fea9d220be86745f97102eb113a14745b7954f4dfc245e_ppc64le as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:8fa704dfc3118fdbcf03bedf96562e6152b30478e488a098544dc0adbed91972_amd64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:adc1fbccf632ddce33e2d829379c5ac82a267554de0880b2a6674342ba330b84_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:e41112ff6804d058a9991c91dee8cefbbe7c645e710d218112c1aae786a9f0f5_s390x as a component of Red Hat OpenShift Container Platform 4.16
  • registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9@sha256:a9120d1bb4fe279e75faed47175e108596253ff087e6808e1a859b06b4425b8b_arm64 as a component of Red Hat OpenShift Container Platform 4.16
  • +158 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)