RHSA-2026:50681HighCVSS 8.5

Red Hat Security Advisory: OpenShift Container Platform 4.14.71 bug fix and security update

Published
August 12, 2026
Last Modified
August 18, 2026

🔗 CVE IDs covered (2)

CVE-2026-44486 →CVE-2026-49332 →

📋 Description

CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-49332 — openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on WSGI/PHP upstreams

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:3dc6b980b16e2da236dbff7842bb379a7455fdaefd3a65b4df9ca5f4c23cf99f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:51f37578ef7dd22d8ef8bc73dbe2c10d54a53268b2428db6ba4a664c0d9510b6_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:93b33c8b3f5960907bbf4dbab92491d0eaecdd44946f74b660ddbec304035b90_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:a8d5c542d37394d3db7eaea6d978d84eac8aa543f307add4bffa05308e4b1747_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:2bc8a254474ff671cf78c7cd12e42c830d10f2a888444e4503f846960753b38f_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:cb27bccafa93b3dc6026634687b6ae4d3a55ba352c546f0ad6cc8788555e6cd4_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ccf8c7ebeef1ce89ba6baf1245cfdc4146db124a3f61439952139bb468399491_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e7bae98115185c2c064ce823dea4b28545d60b4d834fdd85fe98d561475a415a_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:9c115b3a83fd8d85de6f99608cb7c37e57f5ffaefe0b2df2bd19f77001ff9d91_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:dab3a7c804470b949eef0b6e9b049826efa08617a392dbe78ca74b3995f06a52_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:f7c7d2575f8556c84a15bcce22878a30351a60d30054315b954dd5972d5469d5_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:fcb79806f3d97066220adcf016e3fd218e9f1faee82057e716ef9d6b8b0557b5_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:0a2e81db3d3360808165320bf99bdf0fe94d2a5ef44a68bb593f04da2dbbad3f_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:1f501f69663a5ea2de01d75ea21ff5740440400b1c4ae806ac3a95d039406e00_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:2c2aa3dcece57863b139b842b65fb7fe4de10a6195d38d0f0ea46ef66b14b917_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:7b23ad55b01d11c173561c09d43effe690c9052a27d4a94f441b767dd0502fad_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:3b5c17f6146e731f9f3949e282010dfc35ad7aff330695052f59886560062844_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:78772f72e492f97c51a30e6621e82d90392b9b9733b376ab9484f423c289e9c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:adfc166caab1de38b3d02913e2ea88ed2a6f2f913b28830410f28b7bc44bf1ba_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:d8bf248c42b44e415611f06dec760c7dba29287473070aab7bf0a369d35cc57b_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:42044cdc6fbec339749f7aa8bbd730e1485126ffd3918f953cb6e6e3da833274_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:43a5f999835a5db922658dbd647b931445216e5cc6b63a9acdf10879440064bf_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:873e9d641b483b5b5edfc4e5241e946ee5ca503e09b7ff68d7ba632c9c0fb6ed_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:a304ab6b5c4425de4b309a42c06a26f1a04b46b506b5fdc02e36f2fefda566ba_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:7b4132c9d0543e4e5f375fe39ccfb805fd002b41587b63718c330aa2b7928839_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:96d23b09e6789b4cbce703504c672e4f3fe35fec86b95734b0df3c21d1c06687_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:ab8e49c9a6966370101f8bb534ea3271d92e54155c678af9728fd1d9185f573e_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:ba780d413495382585a2d207a67b6c30f3d1dee1ce921f873e62841cbb6903e9_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:039b3e8432e42080bea46e4f2ef40e76c23e5d56b6dd9209e393aca2712e0c5d_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:0752266a2436f5e7ca9d7bee0759d0ba5a526d9334b9ada3d0bdab2d7b1e70be (For s390x architecture) The image digest is sha256:daab848443041c998831d52a49e075e6face410db4f4eb474c9aa60ba7c99f7f (For ppc64le architecture) The image digest is sha256:e57a640dca3ed392b171576886b090da11e5fc3315d83c6ab975bc646967f717 (For aarch64 architecture) The image digest is sha256:1d3e843914147342b1a240e000b536dac76d58105a1e33f23c96775aa0817898 All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.

🔗 References (5)