RHSA-2026:27010HighCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.22.2 security and extras update

Published
June 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products195

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:015eef3d224662511f0ec1c915e6be7f3df94a171971361f56ebea9504a64dce_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:268721ad58def272d91a7f6ec8945c943ff9ad664f08ecbffb800cdc35f02b3a_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:83f0e01366ef34815a20035892cc88e4cd63134bfe62114c906959235019beff_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:e8681041f99db67b9e93dd224a47471e976d3ace205340aee8a533ab2c808ae3_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:257e2b35eb54800e9e0f3866c910bcdc7c49d0e00446a42a0a7186f7297e805b_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:3829136b33cecd1c14a4b47252df16335cb7d140f9d986751b5cd2628a8e59a2_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:5089e9fff6618ca9c38ba381743f75d90b593c7b848ea00992835ad8ef086b31_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:feffd229bd5c8f63627580fbb021e8c688ea75dca307d42e44cfe7d89179f7b9_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:0cc5524a32884222af3e24fe8f467033b95715c246e473426ab7123a5a0abe53_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:591ecfb4bba06859fb0fa1a8a8eb4a617fe316fe568ec462736639e78b7d8250_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:a1ecf168fb16d5db0c10fcc42513042d58da5de97162656a680eceed71f8a5ee_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:a2a8864e3f12d47202866dc967726567f61facda9955948cd999ddcc1a115f2c_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:049b8c5865d316cbea659268751d80a06a97904982c506668d5974494aaa1624_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:05c769ac0736e073e8cbaf49068ede50e07fa3f4075af4f4a7e8c5f57fd00d2e_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:31f3e6b523f349c691ec5447d5aca0029764c977b4abd18f1403d1e23d03d5bf_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:67cd6000ec12a77b34999b61af358e6a9ab49ba08f788be129ca332d08ec1d36_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:5fa67436a8151822bd0ff884f94a5fc8808a573846290edf160257a7b0fd8216_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:676428e03819c4a34eb2bd8a97850dca6b05555423c32ddedfb03687bc7adf4f_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:8d02ee0cfabf59413114dd4f235c7dfdd66fdce3ffe1334d2fa8f89433af4374_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:cb20d4dd59c67970091d614ac8f106e660a0145c5fc0b4c72e9a803b637bb645_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:a551610c07285cb96e0af79581e539eed30c302742db40f0cd9ab8fb049f3767_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:d6a0891aeece6d6afac238ee9f1682ae2c8ccc2871cbe6f6c0c24157b367258f_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:e5ce99ef24f42ef871a1d4b10d63f48f488f0428ebaf4accb59976726ce6c6e6_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:ea312c528b1a091a92ea1bb7088f3b71ae99e2ec6b53308f737de45ffb3affb2_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:6ec247217730f3f0fb1a5f309a114aa9c230ded6e24a1e573231fdf245d03742_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:90d836afedeb1e2c7b435866f73ce60a2e00e64268b79d1ccefd9613289483f9_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:b4cff6601a9f44a78fd1f0081b0f478a48ca337da56a33c0fa6195a5440a5723_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:c5c34cbb1060aad2fbcfe208e44db6eb6dd4ebcd7b34c7110ba8cd4b57e65167_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:5cff83e77fab82d667e25835604e1bbbf999ea98a8110f43d8c427c14fe3a58e_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • +165 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)