RHSA-2026:25207HighCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.22.1 security and extras update

Published
June 16, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products195

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:5ab8609083046c1d5be2f3e73131d386d87992467eeac04d87842e49a1ba0b22_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:5dddc8c0a9a4de9db1df180cf8ca80219921241bd01e76020680827b87aa8938_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:ce3207a92d7ef805f287d12df9458f876955a18fde0d188c30700e8460720669_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:e5b450b342a189408b8ad34899c06b45712ce07244bdc95d1d53bead5927edea_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:45b212a24acf851081ac2cfbb88aa56b602a588101ab9b9dc2e395d4b7f169c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:52907659049a5659b2c227f1fcdd7d4445ee629ce1c90710225ba8926c793f24_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:a37f8e2841fc3481ff196beea3c783ee3d62c6317ce1d82f9da72ebeda496b08_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:be1531215047054fcb9f87417a22723613ac67c32cd9f3e82c710fd30c0c467e_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:19035149e280dfa4f9f696d0253b1feb7cd1b04ab763bbc7a6936703a5c0259e_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:7c6136911f59a98fc84eaa27b59b9033a96f2b8e15573cdfb35790642e896860_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:e3b5eb683d4921bc2cfd134ef25f8c351a86ca94291fb0bcce4c9dbd5b13522d_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:e749029d025ed2a8d9ca6ce0b8e0cae3ff1af732140fea7811d4f64c8547d87d_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:8b5247bc7b3ecb070b3cfb3c31ce503c0544ccfbf539bace4477b77ca7b85527_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:b4e68798446163c04dc4f45652dbf8a8ac412074a125504b89d4aee8d89acd5b_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:c22b23da98ed27a42c1439652cc8b007d018fe1b0f29f08a4ce5a16b1292cbcf_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:d9be9f52ccb15560b0df359168bb1a757ab872e80e243dfce6eb5511024b95cc_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:1fde263b9d1de5205f11b7a949d39f6be4c0be1dfe8c35a8d5686291eeef3cdd_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:7ea14b495167ed56bb422076184a8701d9aa73424a8762092e66febcf00368cf_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:bf8ad58d28c6c4a7956dfe37eaf2cade2d8e9116351367860def2c4ada3b464c_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:c1cd63e6dd2e650ee43aca5adf0dc50a590ccdb58498ff28d413e54348bcdc99_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:3eefb6d276796591377c9217ddb902b3f263ef747238a79dedcfd3b9773717e0_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:65bf99075054650bbf3a54cc15e6aa32452d15182ad022f8e2bfadcdf4fb1898_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:822f615c96543b10b185db60ee9e8c222c978fd6e207c032ecc68299669ac773_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:898d74891e2fb42c1da53c30fd7428db40a4392c2d1adf15a033ff8b8b90390b_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:3f8f8ae5b5fd64e3d9c18ce16395537e5c158fb088828b2dae232918b7f60318_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:5f16101778249011027eb6f6b8a0ed0efa895bc3467c35dcd55fb06dd4ed0558_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:97d58d95e34ddf900e7a9abd32b85d034e0843e422cdb69d6e2f0b17050569df_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:b56d8ac1c2eb568a75e51643babd747cf9815e736185fb97f96d9a56dd9930e4_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:1c3c122caa93cd6cc13e9d15f80721f4e6b8d5ebb0607ca8caea17253982c95d_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • +165 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)