RHSA-2026:51025HighCVSS 8.5

Red Hat Security Advisory: OpenShift Container Platform 4.21.28 bug fix and security update

Published
August 11, 2026
Last Modified
August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-49332 →

📋 Description

CVE-2026-49332 — openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on WSGI/PHP upstreams

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a50c24e18bda192d26302e6dc302f9e64cbb48b450e713db3d293fb9efae8b5b_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:b394bd6f0e8658f92d5ee6848a3d5af1de14d239ab5e73c28563d68db7953d74_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c2cdbccb330a5d95d04459d2c0faa20e0774eef4ce26962f67cafc5564065860_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:ca45bbfbc4f194817be1c2c6966371c9d84bdb7a5f659efbec45aab4b2dfe41b_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:021782b2d2c35fb4c19a397f922c29d235694b49a37bda7c83a539a5860ba535_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:39f95929a914feecfaf7b2c407007059f40e5ddac694e756aec297f19a206a47_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9ca8d603dbac73260c2a2cf36588aa548b9800afb6fb7bb8c55ef8e1f979948a_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:afd092966f227dab3ce221542e349953be949a266fa6b02344a846215de8c68f_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:14f26dcf7b4e710736e347db007c716d7c6da61b170f550d60cc82f21e552869_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:2cce307150f61ddb6de20d31a707735ba198a15c90399113ca7b742104863310_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8ffda0cf4ccf7f154099d272fe07cb0ed7335f89ff3be17e9146abc355ab6057_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:cc49e3bd0ac8a9807333d275dd0804b7a9f4b11dd354295b8e8dc95dca4d4115_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:2f567eb5a6894159fca7a5536e0d52a5bfbf08ba6cf0316348da3505f7d42a03_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:5b4a103ce2a2419c9616b6ad073813e6c0b396893a21c43776f15c3404083590_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:773e2d8f36900ccfd7f147b1c586dab2565ccfc3112f9f5bd81a4903cc556486_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:80d1405fc24ed9610d9bbd5fc660e78daf7c6f6f311b903f26fe19567292fab5_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:317dc6512dd5670c2e84cd247b7feb89bed9370632d5ee9928dcbf4b44461b87_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:73d1458e2ac868ba0d058b594ba7ba13e01473fadd1ae5fce3426edfc4218489_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:7b2c8109cb5e477758bf74e8472a6a69910ed6ccbcd7afa2be260d81e657e551_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b87a2811dfe5b129370377031c64710af34f97f478c107805ada5e798cc23018_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:1eb27fbfb161c8df95799432d329ec0fc50769e9f315c3433c06913671d34aec_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:83c129a388eb1ba4b489b1cc85a7138beec43524ffe154e7ed7ad24ff83f2aa4_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:92491b097fd5ac26d1b8ded716f79e6ab1e09b5a9438a1063b6fb221b8aa72a9_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c062dab8fc0087f758997bb2daa835490232b76d910578cff2f26e49b961d518_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4242982ea60521f569f5d40216080c8ba622c89d1eec5707218394b6df854c72_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:60df4a608f3c6cc07bc3fdb4d763540edac47e811d1dbfa540b20f3e13c6e08c_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:a8976effb67cf8d99d382f433212e11c44bc7b5d317620cc0992db2d64c27dd5_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:d753d96359b9aff7cbf9acb110ec8811f44b94088082a9959d0764c1f1d5d466_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:b17c8c8dab634e35b7fcbf8ef9ae6f394a4b73a26b317b87ab7bfeafd394dc9f_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:bc40cdbff48373c2b65a0b9805d7f98b1ce91589df5361f6fd2a94cf3d055cb3 (For s390x architecture) The image digest is sha256:0bdf5d38e390951689501ad6636aa75627de3ec45ea026ac0b88dd1d94ec4963 (For ppc64le architecture) The image digest is sha256:eadcb46628e5c09e121252651e5211173887fd61aff692bcbad22d7dff2f746f (For aarch64 architecture) The image digest is sha256:93fdc58c5d6fb401349c37de4b08292de7204a1c970398d7dc4bd0013d7f5cd1 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.

🔗 References (4)