RHSA-2026:25201HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.19.34 bug fix and security update

Published
June 17, 2026
Last Modified
October 7, 2026

🔗 CVE IDs covered (2)

CVE-2026-33186 →CVE-2026-35469 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a7030ae2f83595a38c507d43a11232d918988fec2a12bd7bbdd048ed1b4706e6_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:acd1f4c3748eb6189d59cc41da282a81e8949be659f882e241e01acaa25cbdf3_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c04a807f8759be6c847c8f6abc07d398c781563b216abddd198c07ae32c3c467_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:f451c542472d35f555ba7e0ca5fe6ed5cb35b9fc0d915ed32486f1a0c7b361dc_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:37dad142f4de244e37a4cc2b932ea9bab8fbcf7663136b59919b8d4ed4d8888b_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:77e0f36aec56da740886d70e6e9e45b5eae8a4641c11a3584f5ec96cb4c12c4c_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c4c865b5de7ebf517d667466f7af1c3c2323feefc9fe456fe14b994914ea45f0_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:fc741e6ba3a635241261773e48711d1668f5da1eb435a75db33163c1c4725def_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4d84050334b5b19a7ee4e59009b2847f28543e637afb7dfd6c11636c54655809_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:79366a89c1a9d454d121ff6f24a3f7c3f9fee2e1441d0d67c7c5df9d471c3057_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:d6d4776004505cb4168ece720f3cd383519c76c229c53bcbff27b4f62fdfcba9_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f230ae41108ff58cd2df7460ddcab73a59309e5c7c4ca0c682992e4975703b0d_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:1ccc1d63820ee8fe6e1d60ecad3019d4fd4311d19859a5ef4ab43f50c2bbe68c_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:a823b2c4412366f8c9c7baa25b6dd40bfad4eb90b98e2a4b064aafec740f9924_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:aa8dd4b7f6289107e6bb9313a0c3dd95fed0a78a60a3bc6761ba101bf49267c0_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:d51643c52c7f7850b787439e79e69e7e15fea01d38fcf89ede2ffd5aa8a0a6bd_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2271a35cbdd6e75128ea40780dca8b12acff72d89b8e5edb659df03db2847ddb_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:50815dbd8eeb6bb3de2c72b3747c700314ed3ca55130ffe6bf1e0368ac55a40b_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:73459be1c7c70819c0a0b7ef2e41c4f7c4772e24eec5ae382fc938a873e6f706_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:abb274b9924c701bfd460bfaf347842aa1c6e6e5ac13bb67a6e8e13aafdfa70d_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:192a0a4c23acf7745a9cb39db76a8a8dc351faf385ce96a51e3789b9f51aa93a_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:64dd85148fe0c37c97dea17bfde5d6bd28651e85d38dcd032ee6a6e0d564f20a_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:98803d660cb292a0b19a91c024bd8615bb4b6304b6d5ced3230f164b20fa5473_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f14489a778119e4a3e2d24b85887b8c732d273b06ccaa1f3c47dcbfd593f4e5f_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:1f7da1d39bf1e91447e1e88df1c5e804567619b21d4b9b6b5bd3986ffe73eb05_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:7f1abf185014eba5af23da250feb4cb6ccf36627eda3f383172b4ac24866285a_ppc64le as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9167cb67240069de0d391f33279d036aa95cd53c4e90b9bea9919c1121f69a30_arm64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:99fb48017ba08b4218d540665c8a2c5020d3dd3bb49241a56bd136e5337b9c83_amd64 as a component of Red Hat OpenShift Container Platform 4.19
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:1f82e411ff1946e57925f552c6dfbf1157e623ba62ccfbdf1d4e07c3c76f24ec_s390x as a component of Red Hat OpenShift Container Platform 4.19
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:12ba901e472743bd79695772e65a451ac80ac29200cc06076471c42ed0956675 (For s390x architecture) The image digest is sha256:33b55b92bbc4790ac37d4c7b11d1931a2240510799c38c1eca5aeb56aa7e3340 (For ppc64le architecture) The image digest is sha256:3f3b589bf1ba5601644293d48f27ebf26cce0af703edde58001cf88f25066808 (For aarch64 architecture) The image digest is sha256:c5b6085ebfabad3ca4a7bcf4c0a86bb7c1c2454333a3a75859eb0e7b85a609ee All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (5)