RHSA-2026:54770HighCVSS 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.22.10 bug fix and security update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (9)

CVE-2026-12143 →CVE-2026-14362 →CVE-2026-27136 →CVE-2026-39831 →CVE-2026-39882 →CVE-2026-50237 →CVE-2026-42965 →CVE-2026-46597 →CVE-2026-50236 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-14362 — github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39882 — github.com/open-telemetry/opentelemetry-go: golang: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading CVE-2026-42965 — openshift/router: openshift/router: cloud metadata SSRF via FQDN-typed EndpointSlice bypasses destination validation CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-50236 — openshift/console: Authenticated SSRF with full response reflection and path neutralization via Dev Console webhook helpers in OpenShift Console CVE-2026-50237 — openshift/console: Namespace tenant SSRF with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via ProjectHelmChartRepository in OpenShift Console

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:331d34571258bfaa415cffeee68b93db3ea19015ce4b15ed39ae150a61adbe3e_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3645545db95d099b9aa167a3991c188cba2102c04dd7850955a0a2b235d0ca8c_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:796b1a6c8ae21c0be3f0c4b5b34bc2a549ab9080c07cbfd2ee8eac6ef47765c0_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:a92d713e64d0c20d493efecc147a2d934e4ff20dc769510d532f37b7ce2080cc_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:29e02b6b124a8bdb45c2df93b75b8c804a3e12b3cd89c373a4ae9cabfdc9f05e_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:536a2a0219786a1cc18159149fef345e1114f2404e1bdfb903b0ed0555a12bd3_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:6edc53a263199d2a9155ba7b7f0741b4ee4789ff0dca0f9c757e2f5fcf3bb008_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:e4effb2e2bb527f53d7349449ca15964a1da991cd33782ecb81f4db04946fe68_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:1a16f5da62dd4d854fd071d4d81dbc9fefeb5df095dc51200ba447b46756d4a9_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:98d175d6cf70cdb0fb2e5894034b01271b466a32e4e56a84447b4139cd477145_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:ccac2d6ecd0d0038dca8ba7eeceb0f5ba4e0c0b270a515201810660350be390a_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:d648d01e2ef0661ba41590d8068ed22daad45fb28ea961b6caa4b7cae47acd5a_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:1929e4117b2aeacb5e9c637d27317f91508dcb80697de14fdb6c8aa99098a5ad_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4366920fe4cde8fd295ab1b5698fcab0c262cf41de2d3f8170db4dc682c571c6_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c1c0e98f4ebf7511fb316a4cca413ab1307708bfd132b9924adb5b0faf93945d_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:fee4e0bf11b26b1eefeabf5b0caee53930f6b94d39f4c9fb0eb57721538cf7a3_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:0c71d39cfcbe11f9ff7338a19e8b934463df34828ed3cd71d70435170fe54b84_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:51c1e8ce8e62bf5f1e5206183195edfbebed8d80e70c376fe004f1b0781527bd_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:5854ca65c199a5dccd34ccbdacfb9a92815d92f8fc6afa3a019a637a41b0ef20_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:9dfe0d66c7bdf7e2d9cd13daaca7403597c07db10b0964516d4789c66a03b24c_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1562a8ef8f006c294514dd555851f7c48870dc745a816cf34a32e33e96ee9b17_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:15945edd0572ed28b1cbfd602b2f98058fb2b5eeae450e72e0297958c624d3a3_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5889b10219441e5201e299874d5479c579b5c289fd77cb46343b87294cb86e68_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b922bbb40e46cfbea28a78c1ad8d5ba9d42e9a02de96b230e489dd54af9558b1_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:380a52d813ea29f10254629dc15b4315f0c6d0cc85223b5345cab74d001a4997_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5df8ae9c3c885c8315b7ac9cdecc374812a7e35abd2eb37043f5b330af686478_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f5568f3a9091bf2647f7bda661773d164627b9a3fdd0959c2644aa2348d24224_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:fceaaa9b47035ff50bb04fea7ac040ca3d8effb200dc462bb7cadb7c6128b706_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:9d15025257f172cecf3ade710153ac12068bcfe7e9e1c099c715b29a2f056bde_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:171952b3f8295184cbc98cf89d4aed20e0fbfc06cc95e854d53e8a8a56156490 (For s390x architecture) The image digest is sha256:5d4c79493b883693cfff7222309ece89637bf606f56065d8b5c1ac26acdd2fcf (For ppc64le architecture) The image digest is sha256:7ecf7ab1db0964ab5841c89b48ec6272fe84d1428adde038d59078557752a30e (For aarch64 architecture) The image digest is sha256:4cfd7378ff6b2e188ce37a04cdca2bcf3638ab397f52fb64f92af8cb81859a5f All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Upgrade github.com/hashicorp/memberlist to version 0.6.0 or later, which fixes the push/pull state handling issue. As a temporary mitigation, restrict network access to the gossip port (UDP/TCP, commonly 7946 or 9094) to trusted cluster members only, e.g. via network policy, firewall rules, or security groups, since the flaw requires network access to the gossip listener to trigger memory exhaustion. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Apply NetworkPolicy egress restrictions to the openshift-console namespace to limit the console pod's outbound connectivity to required endpoints only (Kubernetes API server, OAuth server, monitoring). Note that a blanket default-deny egress policy will break console functionality. Monitor console access logs for unusual POST requests to /api/dev-console/webhooks/ paths with non-standard hostName values pointing to internal addresses or containing query separators. Workaround: Review existing ProjectHelmChartRepository resources in tenant namespaces for unexpected URLs using: oc get projecthelmchartrepositories --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.spec.connectionConfig.url}{"\n"}{end}'. Apply NetworkPolicy egress restrictions to the openshift-console namespace (note: requires allow-listing required console egress targets). Administrators should verify chart provenance before installing Helm charts from namespace-scoped repositories. Disable or restrict ProjectHelmChartRepository creation via RBAC if namespace tenants do not require custom Helm repositories.

🔗 References (12)