RHSA-2026:25183HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.18.44 security and extras update

Published
June 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:4d09bf9ae1384a717881bd8e9791d30462af842df9e4df1cf39c5a9e3f0aed98_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:ca042c7fcc0d046b98c239c109399f9bb786072075bffabcf391604f206d5671_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:d8be6865a69585184a74d7b9d7e3c4295e9487d172f77688a084114b2330c21a_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:fdc1cb7a13d9747a56df0cc706a2797f0d8b6820e30cbb9737d3466a6aa9f813_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:58c01f288f26e46a5db54b1720e908cd66874692f1481d3795761faddcade35b_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:950c0af402e304851f7c911c49f85a186d37319d467ec94eb30264417a11ca53_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:be1de44d356b34123bd72ac93501b1e3399bc0d7f454ab41dbf9ee1e891c5b6a_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:f01a16d58d5fd5a7366353330c82c4c1625bdeab98b04ac980c92dd3791cda2e_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:136e9192928dee3b2a2b650e2998257b604d2017d3d86534182c60a5c26ba725_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:49a7862803a48ea4919216a718153cda0d3e2cceb1e7b3191310067486aba6ae_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:6a9debd24c7c1f9fca5f0484d72737cb2c9c4f11800c3333fb5cb719e9fb68ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:e1682313c9cbd1f0760f99af61a39415395b073704d92bba97de50c136c6a9d4_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:0001b49903cb0368b48a237271287e2b5579a7beb8c61efbae1f362699d8faf3_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:36282ae55143491dd562a82d206bc2e9ea8d4f5efefe3197451f1c539ad7f7f5_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:4a8fa6462de7c7ff3216ce4025473254651e3f8a11b973a23b67815d1b73d142_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:d8fa72da4fc47e2db6b63a7a68edf8d552e5109f72560aadd414af976d23eca0_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:5d92f3826eeea5fb284d232c0cb31510e46f2fce54db2b2619306e82d204cb16_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:631ef47a1169586cb737bfda8aef9597baeb44a938e7ddcab8e310c26a8678df_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:a7c7353f650032dca77642c03e019f51d03e0e53833cae3e4a8716e6aa5e3137_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:f410d487f10ece94e49ad03aa9aa54b6584828b6635c5cd66278a069ed9a3f36_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:66247c4f0f00a63379797545da76f072b9d04d905c3490c1e6b06d2a47432586_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:99045a0ec0103824cd7b15967ea1a24cbfa22895b8da40fe90cb7eb0b7c64db1_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:c7c19ecdea825d8402fce7ee3f07f825a1209b1f0abb7d8b885bad4fa8e824c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:d8e7283b76c170d28eaba53e376eeb606663cd514a2efb1097e435a2c6618bda_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:8e7193f7c19de6f69e9e8bf1195ff7127f5b457c77982dc0ea82aa9654b41295_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:8fb8a008770a84e5773858aaa251d2b23af127a68baf5aa102b605731eb32f9b_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:c88d4210daf86e56f8fe6a9e923664148e2a16a2eb3d9dbc03889c475f2ab12b_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:c93d7dc23599ae79223b1cbd7dc62b63f6e6c9985d26b06bc6f3a692b8568096_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:03bae849f44c05a66cc12a3e7ec69cf462de8229a81790d0bbed26bf58fb7818_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)