RHSA-2026:25187HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.21.20 bug fix and security update

Published
June 16, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (3)

CVE-2026-33186 →CVE-2026-34986 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1ba965de6e22af8eb220f1e3a56de2d7342005f9581e4fe7fefec3f0a0a5ad56_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:27f51875dcbe4429367a513d16a3e4f5ec8f77c60837492d101b6f8f8790bc5f_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:43e607892220ee9a58bb37aac197aca1e66db3be4f9dfc64b94cd4a7acfec766_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:7579eaa2d7f9954230a4b0741fddb26f7ea7497cd6205532b24e5517ab2fb1bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:05549b91b74f6015b982253ad589adb77403376b90193dffe61f7bf609a6265c_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:71089eb393c9f36937f05a19f1d1d56264932a02ca15c9fd7c8d27a20fa5f519_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ef3a9372576ff28347bd0581b3d5e66d27b4781db1696b3e992c8179cd87c616_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:fe82d76594853f76a9f931a35af819b232b227ea94b1b7307383a309bc5f9df8_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:2e5f84c3744b175227d3eb4cd11a2148e9b2921bfff03bccf3f30e4e6620143a_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:38b5ff6e2ad448193466e12ef597955bbe6ea0cbbaf129975144f6bcf084d667_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:671e451bfaf8601b7d93655bdd7125c55f84f11154563dbc8db434cac9b5c43d_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:cea72ebd4ee85e5f030194b424520fb1e7007efa39b44927196caaf472b8be05_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:53595fa020e4f175c25dd3434ab46f3ae054556774902b19d3a671bb739b1a59_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:7df88065bbab0bb9b364a240e0f45ea0141b595b9515414d9dbf765163503e56_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8bf7a852bc76ea6d23cf0b0986ff4ea17812db94df26014df0f5b3df1d9a7f03_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ec04ccf491be631570b3a73826d4cd0d05aeb7fcb85e2bdaa2f52fcc33014a26_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:0be63bb7ce6ed04d0fc05ac6ce5eae5f57ff601f4c51a2e4234706bbd540a229_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1708039212a8c016bb15922743a2c41b5b002dd25a9950779c27c09aeb68ca46_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b5c10e52c377c499c05eb93b4a975923b548b09e189b861ef56b7f6d62dffc5c_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b6a4078afc408e742bc3bfee02ce641721d54f54ab5470081b1563bee471c4d5_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:3d59555dabefe7678b592277e40124db0d8413a50669f8b899437e828a9da2f6_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:94339e1065fca70a52c798f760fcf762b64ffff1a90c57ae7d1176adb7138346_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d397fd466cad63bac030b974f53d3d318aa677d89f3ac63b2cde027932cf4350_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:de8faebfbc4a6dfea3bdc036429241c9655634b3ebfc4dfd6e21cacf00acc5ed_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4009da30313b5aaf7e1bdd699c8ea70aa7fb9f158361332acc0a563ee9a8ad3b_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4ad49ff7aa8b3fa90c431b9c03744da628df782544b2b5b63399b556c4f26e54_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:81f47c343f81ae1df64ee3f0e85bd15960e1b424ec0ca56e304aaaba769681f2_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9f1ce1b7481c9a9fe5d244de39fa7d86f218968e1834563b10389a4eeeb0cea7_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:56b8f83cf40af54bedd8b19c100e8a9da7b81f0795fd20b74728acd0d3839f1f_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:e2f30027fa1240272c8a472d6c77218ebc486bb966b6862c121187801a40163b (For s390x architecture) The image digest is sha256:84aafe31c3f70600df9b6466f6d1f758701c46ef306105af008964478a8e1431 (For ppc64le architecture) The image digest is sha256:4ec235e09584bc41d185f7e16405d978ec943670de859260fde0ba150fc12fb0 (For aarch64 architecture) The image digest is sha256:37b527aab81b3151268ea260005b088a7814bfbf55dd0e00cc1c23993bb14eaa All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (6)