RHSA-2026:34049HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.93 bug fix and security update

Published
July 9, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (2)

CVE-2026-29063 →CVE-2026-33186 →

📋 Description

CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:8c3cd4e6204a5d15dbe5fa1334cfd783ab714f14f738025dd4d01396b793c390_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:23c4c43be77bed69a198e3f967743e7c932f6c02dbff4049f5d8ec0450ad7ab6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:840c527e75c4f5c328403fc77c8fd562f46f88f622818e33b1883006aed641fe_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:1af41fe7128a75b075567072c87902ed63402cdf1650121abeaba833c752e993_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:491e90ac0f7ba1e29953be7764e6cfd062014378e8d3fcf40778ddc411e88f04_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:13012c3aa3d54f4bcb360ba051727094e30ef15a6c7a08f40085e0475a1805ca_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:9f84b055c2ce211396be9640e6fd22dce9120ba9fe9a4209399a6fdefc1400e0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:7b1753435b5421391b42f7ac2c861b98fb44cb3d6e4786e058ecb95433c5e0e0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:16d28d99c9be593ab552dc36399fe59befc5c066eaaf1db80e964ab687357963_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:efee53f6e011a8b67e43c85c4be49a996d2292eb87fb582d4def99dc727af124_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:fc2c9670078dacb01b3d975e44f224f690313dd5d5a94c9a0efc8339503c4628_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:95039c0c2117a376369e832727b1cf8ed8db72090e33b517c33218eda3a84b72_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:efb872406f5366868112ee15a8eed933c744582823baab5eace75f518dd4f453_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:dc677de74473d97426b4f8125c3f7253ecb6b50c4e893d108f44f26569f16af3_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:6f6be7e6073dd3ab2df4c6b9336a69de570489e6df039e79431b7e635828473b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:ef662be39c24abdafc223b6c4626d7997d23329dbdc4ef6605a0b807d4f122bb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:edbece8f321aa3f2fb5205e49141c282f5f18de4db2f140c4d09f0ce925593ad_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:1df1c6b05dd162013899975ae5d9089987231f141fd7cb69fc4b2730ee0e89cc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:fc80e7087238e6d75c5e632827a76f57433c77c99cc27a67b940cc2e0e9a07e9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:8a73eb3f8eab43d538bd476ef9d9e523d764ad8b235246e1f09b70869d93db55_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:4a11fa9057ce9e6049b2e50c80e6e1a0e6575825ecb28abd66f8ac2003d362d5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:5f4ab64b7f83467310e30953c0f330022ae5847bd03c8c1fbe4985c99e620e5e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:ac821b44ad51df246f239a8316017297868c211cdcf16a9d89757a49c615cca8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:00e19a4c0a08577d607c2aed09905e0d97afd7f0a3a48293a73c548b152b2c51_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:0d76b81b821646f4c935735c604c149869cbbccdf526aa447c3ea1dc8c36a650_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:27af553b6709fe89c6a7f383a66dd9279da2c748ccf16436514267670491056e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:c3bbe7e3ae350aad3f7272bea585e6be2e959ee39358a08ea1c8cf404a149abb_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:9191e287caa01d739272eb3c1c40dca80d43d10ea2a1c00ee8db064441ca1ea4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:e47797bd4cf233de3df071731ee0d1b5562960a7735fd319a9833d5e6bdbed8a_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:746f1a33a0b89a5489916b10366777b2672b65cfcd0cdfaffe5a710e3aa15f35 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (5)