RHSA-2026:29800HighCVSS 8.7

Red Hat Security Advisory: OpenShift Container Platform 4.20.27 bug fix and security update

Published
June 30, 2026
Last Modified
September 10, 2026

🔗 CVE IDs covered (2)

CVE-2026-6322 →CVE-2026-44494 →

📋 Description

CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:498fada0822496bee1ad2b5f13106d1c7db186dffed7a35a83dedbec1ed3a8ac_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:5081eeb50d58cfae50ab81401e0e129743cd60c2da4385a8973f228678273523_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c71402297fe896b153ab6fbb6b7c09308c481c26e491005b6e64a3293e530f08_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e0f21d28bc31d9ad0fd91943250ac4754f1dd045e8abcda8b673685fd328762b_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:353fe841d1b271ffc60cc2cbb6d9d6e39edf620cfcea49a2ee7fcf2a8a24a198_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4674101b6196ba960d2b5c851f1c2342dc2778a7548eafd3dc1a0970b8f2daa1_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:8bb69cafec6eb4aa9f9fb2fa717209c9346ffe20876040699f143d6afa4d3b8a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ca4ac40fcef6f56208b72b22b05f7e8f8d6e8224fa373106343abba921c27431_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:017ceec675f4dea4bc6b32a4b97931bc15ff29e0f57f146783539927d1f5dc4b_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:1118c37c56c785bfa6563efdfc7ee1db25d12377c30aace82e533dfa246ef31d_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:69a800e31cb549d7b78cc53f2f3621be97b2414baf78a039c44f9c1591d647a5_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:e14aa5b79d4253daf6939a43b0e0c6661824e7cf43c330764d46cee3eaa6ad78_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:23e1057b87b40a8281bf5b1d6efa4d864e4043074b1a0104992bfe0730745b35_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:33e0e215ab27dbb4ea7d9eea1e5424ebb98fc75caa65ac27a4f3dc00a49c2038_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:67634cb08e081a30f5cd5e5c325dc4d1246defd17616a1b4f9052ac5bd955f4a_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:d5c71da9f6bd6ccc6c6523bf3501fed5cd56f53242e2aab1c0c18cb718bcb9a7_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5e8e372fb0b25ed4866f3edc1c0af37ad330604b866cce90d0db02ca6a53a9c4_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:82815141e9c783b5cf45794e477ceb327e2b3af82ec04e8e85880d8e09abc123_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:bfb79f08751762a40abe5082265bd6d7b99f3900005fb363e016f7bf9dceb00c_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:d730225bfebd73799b53a62b6f79374711d50681e61f43fdc024778299776c16_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:46d5e919ee16164e808b8c9e7b917e3bc20b443cda184772ad44a49a36bc7b5a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:69d07b70ea54acd214253ec05a6f662089c8f6cc62011e4730d0759a573f7d07_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:6f82b2e5254994334c11c85feddbcd9d5398348f54b30c49e86815982d507ce4_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:df927ba1d9020da4f26eee7df6a9694da1f8738d8e8fa837f6c2539554da6f6d_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:395a24f2a9f37d0ae5c7986af65896ffd58baf8b839e4da73f19801c5f972e27_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:3a763b68284bbe0b063e254800ff50f1add8a8014627700a28463196284a6d98_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:42ce6e7854949a9306c4b3205b2db63d4c31b8c6fb006630463f334ec2c9c976_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b205b9d0e5cb3362b62537d4a9912fef6a5f9dc1c72cf488e6c69674cfb0a325_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:277ea975ec5d9e3b0f24463e9c973c1026c4ff8bea29b78c997999b15d88d766_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:05f959160351e81679dfab48bab274579fcc320244cabe974410718b132445b1 (For s390x architecture) The image digest is sha256:7aaa1d8ae43dae8612e133ccd49a8dedb44583901d66308c3bd325423be0559b (For ppc64le architecture) The image digest is sha256:28e677d97a6a9219e8f661aaca70a0b0190972c0d1173ddabfad19fe80405ab2 (For aarch64 architecture) The image digest is sha256:f82534b7dda297c688947f35be54c9abdb62fdac30a6688c9baab6c8eba7a449 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)