RHSA-2026:25195HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.20.25 security and extras update

Published
June 16, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products172

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:2c94df4cd32b010ab7d37189f82d7f96e680a555bc111a92cf2afe7d623f769d_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:565587a196a83dc02ff22150f621205580ada0c9a612b5ae7f81f7a0cd840df2_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:86b1946b0d17f8a8362da0c4a92de579de62fb8ebbf663460d004ffc3bf37b18_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:f18bc8f41b9a12bee6914be1bc0c0191ed6c6b011b72709e39375e2cfac85577_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:4957fc95a32e9e58e7574bb054755b0e939f69c49a00d500bd99dd342ec2108c_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:a9db266180d686a86fbdec53aa1fb5806fe6308121017dfcb61f064efff275ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:ac7c733a1d501bac474d98900181e8822bdee6cb6b84148850c6eb9e1c4562d4_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:adcf2604fe70820c1e26fc96914d6291072d1df557e635e9346e20742aff893b_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:0d5237572f55e577b134285cb4b9780995693f78b9ef72793644bdcaef395591_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:470c1e99ea40d4b49f8fb2de6b60632aa799e28ed39ddc44ec0c70914041069f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:9dd1451787189cf9448b978b1595e21ff5d10cdf4390386c7711ec3b10c90b54_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:b5edbfb87a64af390d3c66e5f9d6bf47cfd3aaf120ceba18dcb7739f8d748514_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:46c20bae85f471cb842c770fbfe5754571abf33f269b1b33a4101aa8338159d4_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:abca6b24e30139fea6a4c8e366afee6f3fc692d403e6ac4abfd7f12b8112f079_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:c37d9b5fb29ccd67c1188f8e96ecca8da7b4ed7dbbb5bd5cdb75ca927ff9f0b3_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:cd93e063731eca0e0a81af9bebf49787dfd37548c9c454e7ccd22353ef7ec27c_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:1df9e36c7afa85458daa6512bbd91b370d60165d348a49c2dfecc716e787c926_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:2fd436736db0a34557db5ddf1eff5a51cb872e5bd1fabda461cc5f531e57a213_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:50456d037a3e6238cd4f047d7a4c229987a9b4faa2d2de28818c3b4229fc59a8_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:8a058e9269050e05ff5df9bbf6c92740c1ebd081c9dd8071e56178763bbdd2c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:66553dcdeb9b568e7712f2888d3e7312b475e06d0ec86dad3cbe27ab0e3538ab_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:8b77f098ad594c1ee48495ec4a0be0eea721c2940bf293e7b4a2f66fbe4a990e_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:b79ca32b7852162f42f4649cc00babda1228e074d5c2ee48f9748df9f9aff326_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:d79774c1ad2355b71d68b76653781a13b476949fe5c19f047ca1f6d0ee3dab80_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:0a6b23cf1028b858b61334e3d4bf504a7895517373d28bce10c94fb3622a8edf_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:483f733cdc78157f9e1c07c221b04dbe56dea287e5f1df2c71ac7fa9d4add7a2_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:75033faed2096248c6cbac42d1b4be9d35fd18d08a3a48ed12b7feca131a3d3e_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d64eb22891afd4b92c9d7e889c3d950895c99bf2916c786f61feef6d58f6860f_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:828073b9004ecc533e43897ddd0fb845feeba262c48832cdd3083fa2822229e7_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • +142 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)