RHSA-2026:29801HighCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.20.27 security and extras update

Published
June 30, 2026
Last Modified
September 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products178

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:53a7fad9d16d7af05de232e29f257007131f7a2b06fc4bed6cee664bb0d17c14_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:6edc26b209e4711b1ee38239a92c22f1348a0aa13231d2db9552deee2a802ac8_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9c57a41c048b5056436ae2e44f1a3b692b427a96fe68a878a53db70dfdb0baa3_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:dcf8b4b648274e825ce3d6ee11394c1f5fed01276bf25a3cbdd783659dedc8a7_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:270e497587ad5057ef2ee6ada2823882590ccc1028c89ea98a5a5d36342dfff1_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:a572c56b32e289fa4db71284623ced747c4fbc716a4c5ceba50a95d3079b3bfb_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:aea2d84c9288ce8125f0e8a592b7941f0421f082003469730975f94206cc1a97_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:ef76403f23b35bcd76074018ced152e4e389a46426ce2449cb338e5d7c03fe79_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:6dfcd73199f4729a373d148a44e4dcd2fdcb25e57f82392e0ccd76e0f3df2541_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:99556afdbac24093577180aac2f06b9e02c1c98e15a699886ee5e0eb20683ed9_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:cb7d54363de976a5231ec40ef4758d609b4eceaba97ccb219df3c97af83c5e73_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:f7f0ddd4bbc916949c2d00b3e13a81d8d663fc3bae2962df96995bdc3d6d314e_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:01c030dca061df09e0fdc2f2ded852bbcecc8e89255b6fba1d4177d4f32f2d76_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:0f05a2005a00cdf0bae4cc24bf4cd658ceaf55d4ce11d472813af56d38f07a75_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:482abf843391c27d3ee8f030935be261df2351f88a0153c9a0f03279fcd05d8a_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:e21919b6ae3439b896fd27a7d9de61c14f638727257ed15af48f4ebaba826d3e_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:2d4e3604d2c3b8dd105911f9468ca21339d8286fdb42069634cc3758df5a02cc_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:5f399f54b84f0a770cab20896dfd3310a9554952bcaa162c30dabf63ecfbf767_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:788eaa3570a1ebc6a4f2c00c7f25b989e4585447b9bb525f58bd7177bbec1ec5_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:a42a83dda9634b6e16ec3c4467c291827622722a3fc5df86dfc79081e14d02eb_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:030a010131d23c40517e99feb6281d9525b418c034198422964d894f18759e98_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:370746b88a1fd4856b17da1482d173e1d4f70a09beda1350e4832b8887eab161_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:59e4c1d82bd6957a8931e8c5283d4c7fa9c416286d4e387d2e81a71cbd6369db_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:8e87d50b354c3326f6c6d58610885fe2777c7158ba934f419acbb49ada6d4d18_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:78e0d586df719a81b27c768135f4d2c7c3e13a73df6386beb9e913b5998d3e75_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:84c03f22e8e816053328c1ff9609ad614371c0186372e6755dfaa38a18cc6b52_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:941e32a19b4d860e16c83558c8de1e327e48087d9ece9a450a315e91c967a630_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d52912c5f0f3bb57dba21beb9247625aaea24334911f18740f650fd9790d2bcd_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:224ab4899ab6d89eae3af156971576bf86a84cd556010227b1d3322ae4e66525_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • +148 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)