RHSA-2026:29835HighCVSS 6.5

Red Hat Security Advisory: OpenShift Container Platform 4.21.22 security and extras update

Published
June 30, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-35469 →

📋 Description

CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:349b74f1f689b62178d691a08ffa605d5435eec881b53862229cd59cf22d0831_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9276aba4192290f9a15433124338294ac06b94d9bae59d00dc00d0951af27054_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:af588cfa29062d6de46c1bbd82593c67b802453e58200fc8681e5ad724c8ae18_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:cd450bbc1f6c198670738c59e24258408f4ffb5f5f8fd0420e4ede6e869db0a1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:02f144027a3c836016f3b151466f878ee0089e0eab408fa55792922c698ced60_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:a5ff655c1edc2a0e558092b9572dec0448a3931e6e9d527583ed004292f618ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:b60ed6e5533ed35929b0297158509e354f093a7370746592e6aab417088de129_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:ecb6432e02ee9ef09cc9321294cd52c370708f712e368371eda7d6c8fa4c0f84_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:44dd12a20784065c259b0254bb8faa3cf2579210fd0823ecde5385b083ecbc76_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:6abfa9088ff3cab390cde084c108fe1b2ba97a30833dc69b9a24c371b621f150_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:a84bba4f04eb5b881215fd2d453c5df60f1671228d6db9fa2110b2b4df1a2c25_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:d78bd7b833278c6fe50ec93192c45229a8821e8aec7048894d642360a3e29787_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:72a7eb673c2b463f75c431c2d6c99adfd2e427c650bae73a99bee74d2f00aaa4_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:ccbfd7e8f24c2700b64016f560520d23d647d72257386185ad8834472a8f1bf1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:dfed5c35daa1bb2d32084422b7c8f3b8c420a39524cf7b0c9eda37be65c606d9_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f40f2ed562619f1b2bad0a70dc952810588e91088de0c041b89b2560df5af0f4_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:10c10ca6a976645e84a5a763428fc180208f57d9e58626054b8bfaf47dc90056_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:6fff85e1fd0a09fa8d4fd1c8f015cf63959cb02980dcfca676a82398893199b1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:951dc6e2a2371a7b3f6e924cc01d3653d9fccfad9b1aebf90308edd04b131ca6_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:b260dc32e0173fb53a9a3b53aaa36d4597f7e900f215ad13c955fa045b6a7a50_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:20f1b348901597f549c9cc218cd18ba89053a9f795dba463d4b70d935133ca25_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:369f94312bbaa9b8a770b61cc3ebc4e2032737a535ebb1649ba65aa32b8de575_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:741e887e5213df588ebf91ed6c964a6f9e0ab756be4e2a1d145078faf23d6962_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:b7ae0bda0fcd428319566da992df3c8e4a0bfdddffbc10c0d6414079dbbbc548_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:0275ec3b3f1951c29facf095a1e11c019494adedf9c9b04e936fd9e67c8a951a_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:49c83f5d2733d6dd2fe437956c94f4fa3cd974ab55d2428ee2eecfea498730f9_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d5b321e8e74813083283ac7ef58186014452d5a3b1ebae8949900209bfdff6d9_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:f4b9d94f58f640aa8b141f495be2232ce58117b619f5b26cbed3480bbda549bf_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:5707cfb96b4c707b25891e6153a658df0fead14100aaa9a7e45e424ffac7b85f_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • +161 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (4)