RHSA-2026:29834HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.21.22 bug fix and security update

Published
June 30, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (2)

CVE-2026-6322 →CVE-2026-9277 →

📋 Description

CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:10aa873a1cba169ad63d47fed3386ad417b8dfb1c630ff3b6316dd60c5ef6613_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:9c019a1b118818cbee0ae7e7a2e922c24e121010cdf7c5e5062b23a5c848d286_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e06aa063849e955f5acfe133545502919e7325921a9b5bd296714f281bf01f50_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:fb2de5e21b0381ef5076cdbbbd5ff45c607ac1e41e622936953f8cb44ff76df7_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:0e6252b1644014f2c7b50cfc4cdf103b54359bba59f2573dbd8d4d1c59149ed4_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:464d600bab27b1fff70e92073364fac738dba592e8839162bb1b78ffbdf3ab62_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:5e8f0fe9e6b41bedea43625a39beaaf2da60815ab21c03ca7276518b199fc44a_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c7c936977cad0a1ebcceb5f8df05363fafe100715dc7d8f76fd242f5d02bd1dc_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0474fb46c19aa348b212edabc9923634b3f2043aa64cfa75e7e990b1dd8d741c_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:2d359e6d42be3926f37fa9343f2302584b58bde0f65b362612d3c2fb00602a15_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8bbafffe1288b24a2ad04b80af59b86c3fb770ab7dd9370bee0a14e130f4e2c4_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:9e492d8b9ae2951d0da9909538e09753db17b9460b8723450ce429ef9b034626_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:15a87f4bbf03eb364bf97331bef84cb2b3ce0992c9a86b2059013b52bfaf9863_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8b960db0cec80fbc13f6bcc648b50c4c84ac1d8488a1b1d43565858c11a86c80_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:951d29a8c9fb02d89dad18c2057e2d02a62797a534fe18b49563c2f248686aad_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:961c1f7f992febf02513e7506a5e3992cb2f6f13e6708194058de561282b7adc_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:35dc4919e8c857d56805b4f59db518f4f9ec9879f3fc80c2e185e26003e666dc_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:940752205207dc06a9c9200266696d53b0d37433db17fc9050ae4ff3800bf9ee_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:d36a189041f654cb230613bead9d4e8bd3d0f606bab56f672129aff76be92bf4_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f16fc3462cc357fb2b659ac8fa8e1adaaadee87c77d763d98c3f8b1fa33ae01f_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0096b6416167caf423afa3a7a1f0794ea2115adb3bd1ef883cf78fd2cf613923_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:42bd649c50be909dbab44186fedd9cf7a75eb51a3a9d4de6f190552541e4ae0a_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:4b0b05dee2bfed79dea0a0fba344148265fea2a5bf9c03696fc8391fee16c2fc_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:b0245dba25b6e5240a408b3518b94c9630708b75aeff6d6dc09c348d0a677548_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:5922b99c11df8cd3af2588fe34b05719ac147bc92db40ef74ef80e10089e0d5d_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:623be299422b7473ac74e235d62bc91a71b541c125dd490cd31133bc3c4db261_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:bca7a74f428d2052a210ee6154b4bfb330571e16dcf89d60994d6577cb064c0f_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d5cfeab22ed572f2938a2589b2ba58d47b96200ab66475c5e7883b04de1f83a0_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:6eff501d8fb8bec5f2cb1e952e3f33c5650eeb9d18bdf6ee1276aa9c13c2c989_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:52e54316796bcb6f31212edf0c0c4f89d0383232371d5d0a5cfed1513198b94b (For s390x architecture) The image digest is sha256:1ffc16865f1ee1ecc25fc02eb8c9e14d074ae8bf57928665afc7890b002a3e3b (For ppc64le architecture) The image digest is sha256:d95843b934c121e386ac5499b0f7289017bf9c3ad46ede745c23431ba4fe804f (For aarch64 architecture) The image digest is sha256:e06817050a33fd33ec58e7e2942921bd91ce3c736a12acefb74dac80503e680d All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

🔗 References (5)