RHSA-2026:54583HighCVSS 8.7

Red Hat Security Advisory: OpenShift Container Platform 4.20.34 bug fix and security update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (7)

CVE-2026-25681 →CVE-2026-39820 →CVE-2026-42499 →CVE-2026-42965 →CVE-2026-44918 →CVE-2026-50236 →CVE-2026-50237 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42965 — openshift/router: openshift/router: cloud metadata SSRF via FQDN-typed EndpointSlice bypasses destination validation CVE-2026-44918 — openstack-ironic: Prevent rehoming resources to nodes with different owner CVE-2026-50236 — openshift/console: Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console CVE-2026-50237 — openshift/console: Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:487ad9931f6a6764d3561de9ca2b299a15e6358af323b4dead05084dbd384bfe_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a8a5e97953c61043e6a82fbac3af920bb1019bac68ca2172059dfb7635a0e967_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c222b38ebad3136281aa5be4f4a01efaf1cf59dd0b2fbc0ff03ef61bdb521ec9_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:ea95ac9148711641b411c17730b3564cb3fb623196513b585fbbce5927046bc7_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:5dc40309ea3b4f6208ebb8fe0fcce13cbffd8c848bb6956abb232e475214e82f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b2b503404c231ab34b3d8381cd11064fecc56a25769a59f1abdf8269f6468f7d_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:cbba5a81ef5485317a32b86a14ed4e68683dcc8b8a71b73ae632e9e28d66b0ed_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:f29bf778cb1a617c3609672fddd61e4d91c85526b1f6b8e3f191d5434b3219f8_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:090f1b0ec9c9839dd7865d5f374482ad1fe5909ae107937d7eac31e742c3dbfc_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:72b19459b632118b3049911dabfa5bcd533bae7d10fdfd0f1aae7f1ef00da55f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:8a67646e8afc522dfd7741447891fd660bd51c25c5b4e5823c211ea1cc737a09_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:9648f3b41bc8c92aae4d8c4f67c1fd41b33e94ccf9d65540abac49235497b2d4_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:2e3cddd89273f67ba23fd04e67ec26b56d98462a5069a29fd54f37f9b56be686_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:3c057c82ca003ed3044a913dc5294f3ad867dfb8204bf606b0ed5f34a19df028_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:58804d296265764a664786da3fb9e1cb893862f49270aa71f5ed0001dc346994_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:9372c5a4e46c06977f0565a3599873080d2a967e11768e874e1545c5d1eaa134_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2b4ce73b45d09c95dab6e79ea5a528ed8adf129a9af704d1a8b3cf1c8d227afd_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:3bdf437340c56b1fd06952c6e31d149be3204de8e12bd09dcac30fce466ac1ff_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:541106534f016d1efe16a8992fef76592124d6fa893727736635e06fb41d22e9_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c04705215bbf31eb915e82d3a981ae340686eae4436a98cb8ffd0d99552f8767_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:7dfb827463dbe474afa8f421f3021f944131beacea57b503e2a0aa7427d86299_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:84b43f322fddde81a9a6a6f3fb89e23fe4542a2235bcde8186cbff7bb7092136_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:d63a04522647be63e487157ec6ffe9d603a76d51fd48a403e40d40bd0cc49d45_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e830015ae8058e757c859e81aaab6b72dffb8f6c78117d96143af479bd8a61e2_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0fd77d6710d4242eca22c24650eb9acd41e00eddc9ebf4481c7c5118d524c51c_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6d2687abb588229e5dc2fb8f27e5c77d572f53f6ee0678e7f11b49855dd7c499_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6f61df198f4dab74235569c6a62fb17a4478833b40a1c81fb56dc47e8033f1bd_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:f92f3d3909dace6398ff72e52d89009bafde8432de56fd5be3e37bd688f8212b_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:1ba2d139579234b8793e6abbcffdb0358fea1f08f74efcbe52a996e982994076_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7 (For s390x architecture) The image digest is sha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc (For ppc64le architecture) The image digest is sha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1 (For aarch64 architecture) The image digest is sha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Operators who are concerned they may have had this occur are encouraged to perform a basic audit of node configuration, for instance, ensuring the expected number of volume targets and volume connectors are present. Operators can also use the provided ironic-status upgrade check to identify misconfigured nodes. Workaround: Apply NetworkPolicy egress restrictions to the openshift-console namespace to limit the console pod's outbound connectivity to required endpoints only (Kubernetes API server, OAuth server, monitoring). Note that a blanket default-deny egress policy will break console functionality. Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values pointing to internal addresses or containing query separators. Workaround: Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{"\n"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories.

🔗 References (10)