RHSA-2026:47728CriticalCVSS 9.4

Red Hat Security Advisory: OpenShift Container Platform 4.17.56 bug fix and security update

Published
August 6, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (10)

CVE-2026-13676 →CVE-2026-16242 →CVE-2026-26996 →CVE-2026-33186 →CVE-2026-40895 →CVE-2026-42154 →CVE-2026-9697 →CVE-2026-12151 →CVE-2026-35469 →CVE-2026-46579 →

📋 Description

CVE-2026-9697 — undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy CVE-2026-12151 — undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames CVE-2026-13676 — fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization CVE-2026-16242 — hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates CVE-2026-26996 — minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-46579 — openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7f00e134505276ccadd97dbbdbc6db026cee2a6dab25a6737a198bbe8930e797_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9a053d475296493235a02e105db816f7760be573654439a77ead835ee4d0d860_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b7968adf4edb20e0d11aa50251d5472bddf16ac3508b5777016ffe4e2dcdcfa4_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:dab7a52d9125bcc4dfd79cb4ee0bb8b381cdf346ab2385f3d396e34c7321f1f5_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:ab716442d8691c7f5cfd33e27ac541d8a19acd35ae0c6e161bed366e2827dbf7_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b74b82d71f65762e2f163229d0cec5acbf8107184cb206b216e34221a654b0ab_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:d220d25593a1ff49b5c28abd22a1090767e5360ed182187830da6708c89ea72b_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:e55cf305bb2f08e9e7bec176638f53e81a2a9cfdef53ebe3949d559aa60005eb_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:0645756f450653a59d18ed6f297bcab0d900df33b5dd082cc450a745017d265a_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:70f9c5a9029730b82995622a3726bec5a225e3792a5dd09a20a7d9948d09553e_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:9e75c3c60e30b58ea6edc7cf52350ba1f6278843d26f182bc12e28a23865e0d6_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e4d3def9663099636e5bc92446c1a350343eb995cf72379f8a90615a39d796a5_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:86290d3b48b94f8c87fe16ea6b3ef7d2732fcb419232621baa8c6daeff7e935c_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e0736ae0da6e1ceae730b242a7388b58704cbba7f7249448a0b87035cd5db85e_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:ed15489d2ba15597f78877ff0fc4ec0ec2e83287644445d1c1295a86e76690b0_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:ff0c581e14abffde23664161f8c5df535ae804064333c8839716aefa9428df21_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2d2961ad5dd480aa52befdd93375af285740ff912f71be09a3db693cf7fdab7b_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:571741b8568980dd6548b3c53a759bb874e28e3a4967bea33c0b1f3762984a4b_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b4c9930d6594ed8fe4c4a55655853eead49d933428c7e3ad902a216d095738bf_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e7e0c08a7aad804c694546ec68a4848772e40e267c49d10bb69d0d3d1498eb84_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:0c52e570fc7bd2df80e82177225bdfac85cf2336c4e921b14f42cae888197954_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:d37345ef8cd2767324980766171dad7959b2b001d30e04b8ce699449f7548ee1_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:e45fbed6ab55e5a5e1153153de626021bdf979d0047619b0df5612d19af52355_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:fd70f31588d81a52e4c6d660343848422694c7847edda35971ba29df1303790e_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:4527027276c64004bc3a36d995607b6e10e73cf2183f8ad6bc3e8cbd26a28dc8_arm64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:c3c343f363e994d44d81501f6fe16d36f45db310ac35a9ab9fd3eb0eaa3fe498_amd64 as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:c568dcd00b56562c3a8d112814882087ac4366294b8feff6bae03905c936e4ce_s390x as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/frr-rhel9@sha256:c980a159e9792f5611ee08718a1a83df609de32137b01f329d146515c4b6af9f_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • registry.redhat.io/openshift4/kube-metrics-server-rhel9@sha256:001059b6426056998c5ebcefd8003f9d35c2537f2641bfaebbddbce7e1f4b9e4_ppc64le as a component of Red Hat OpenShift Container Platform 4.17
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:424acee89e2db0e1be3213da3db28967da2c61fcf2830ee8f83f51a48d973394 (For s390x architecture) The image digest is sha256:20b10e83cd8ee11260ba13f3350e5434e34d312bdc36f6a623e1993be929885d (For ppc64le architecture) The image digest is sha256:55b9233eebf35c2e83ace7eb9498a39506374e1383a4894cb5f2d975a4f2ca65 (For aarch64 architecture) The image digest is sha256:b448c5f0dbce94c2a8cafacbb73c3839970666a4140ea38fdab1b0db7fa2e005 All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Until an update that configures Konnectivity agent authentication is applied, restrict network access to the Konnectivity cluster (agent) endpoint so that only trusted worker networks can reach it. For NodePort or LoadBalancer publishing, limit ingress to port 8091 to worker node subnet ranges. For Route-based publishing, restrict access to the Konnectivity route to trusted networks where possible. These controls reduce the chance that an unauthenticated attacker can reach the agent listener; they do not replace proper agent client-certificate (or token) authentication. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.

🔗 References (13)