RHSA-2026:60477HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.21.31 bug fix and security update

Published
September 1, 2026
Last Modified
September 7, 2026

🔗 CVE IDs covered (12)

CVE-2026-73086 →CVE-2026-33814 →CVE-2026-42151 →CVE-2026-48801 →CVE-2026-54423 →CVE-2026-59869 →CVE-2026-69152 →CVE-2026-12143 →CVE-2026-39829 →CVE-2026-46597 →CVE-2026-59877 →CVE-2026-66138 →

📋 Description

CVE-2026-12143 — form-data: form-data: Form field override via CRLF injection CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-54423 — openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step CVE-2026-59869 — js-yaml: js-yaml: Denial of Service via crafted YAML documents CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema CVE-2026-66138 — ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVE-2026-73086 — nanoid: nanoid: Predictable ID generation due to integer overflow

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:69d5018cd6ac1871b52101088c525c9e064f983011807e4d1058f4db54bec1e3_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:8ef12b7a9e1b5a66039e67ec27879c86791e390921f7295877663c5441e8e413_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:d2e39ffa70b75fffaab91df734dc74cd24c103cc233728d65cf75874ed232943_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e6577b9cc6a590e6e1f6788eb460c351580462af1adf4429d75e770536176718_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7725b19ee0e7718aba980eb2848d5ce7291821b398433109b08fb0ef5832f7c1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:89a8e818ea6d7764e7f4fbc308446ddf786c2e614e121da6da62a2a9198a248d_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ec09f6f239f9ca0770a68d220b07603d9f7bea80f809fdf5401f8db759d0dbe6_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ee45f196c52688b344592859802f84160299d1053f34a64a3649002df5e0beea_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:5c556d278130bfeef43bdeca3fc72ffc0aa2d20bdda52ac27653a95e97a4ed2b_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:5f29224de1c6f407b67f1cac5c26082f4bfd01a83c89140bf54d33dda1434940_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:9a78a27dd64eb1f0920134215d0df48cf3a78a4cf9922700f3dfd2d661c272c1_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:f9cc6a2b976584a1aa108631420f64a91dadfe5594c895efdbf396c9225ee539_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:125d8396cddddb89533b2021ffd095dcc314c585871bda5fbfea627bfc854b2e_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:2ac812e3cd99b6c24089b32472efbfe12897211dcfbe17cb4b954ae98dca821e_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:4e934dd1243cdc62a5ba14ba1925e783d2ea4d813428757b4320b6ca3181ae23_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:c1603a0d602dde5ee35684770cbee84bec5d27310ce6fe2a8284f6dfef7f0bf0_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:816eba2a37d97230824b2e684271ebc45cbcfb5ceba62a8874b1af85a2fa0ed3_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a468bff45d8992c47c56b12e49465b5cae8b23d1952c1aea4c00fe99a85117e1_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b15fd96901f5e7c928544aecc43d309099d1f3eee388267344a483bd670b2be4_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f14f82f4a410b3a8e63725975ab99e68a182f893aa8db7f0dcc85005d29066c3_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:24f37c26b4c87951210a29bdbc267665c82fec74f3195ce53d300532c3a47554_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:57d17f603c8084784455ee273cb6dd27c7843fb092babb720da5e22fc8739147_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:60a05eaac850bce896f1e461b5d0ca5688045c73bb3f4c316793145d246b300b_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:6ab05d808a5d0d79afc80782072c497f4cd8a0891ba341fc58d8ac7310da7b8e_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:26855a0e363524d4c6e6f9483ae1af88c049a055866846086b5884731e616aad_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:968da8dd33aa393f55f70ffcfcae937739bfdae44788d48008477bab8e44ba98_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:bb072ee8e32c0af402c0ecb2ee50e66bbaf26aa678be3bcd4b2d822083324103_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:bf075e57bb9c6d074f11091560b7bd924962ed3872f9bc5098d8b3f937c03811_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:239f7a4a267df303ca41ee3df91f026de29b3126706c1532ae0bea40762c7004_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:aea3624423e54d7ca2224823501e0c6d23f4f5f2ff2b335597d1ceb88b4bc2b2 (For s390x architecture) The image digest is sha256:25d9a7d4628837495cab67d59180c04365117a64e4b40592f1b8d7a7e7bddc5b (For ppc64le architecture) The image digest is sha256:b5ffc39c4f36373f2b7b9e9d5cb42705b50ff373c56e52cb7f68b652982babe6 (For aarch64 architecture) The image digest is sha256:51b60d259ae380154b1ceacf7803f7d43da370a12fb0f212e4974883123bf111 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, ") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Operators can apply the upstream-provided patches which add a blocklist forbidding use of the IPMI send_raw functionality in cleaning and servicing provisioning methods. In environments where the default access model is used (lessee capability not enabled), this vulnerability is not exploitable by non-admin users. Operators who have explicitly delegated lessee or owner capabilities to project-level roles can revoke those delegations to prevent exploitation. Workaround: To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update. Workaround: Remove the chronyd binary from the Ironic Python Agent (IPA) ramdisk image. The vulnerable code path is only reached when chronyd is detected as available. Without chronyd, IPA will either use ntpdate for time synchronization (which is not affected by this vulnerability, as it passes the NTP server address as a separate process argument without shell interpolation) or skip time synchronization entirely if neither tool is available. Additionally, restrict and segment the provisioning network to prevent rogue mDNS responders, and review OpenStack RBAC policies to limit which users can modify kernel_append_params on bare metal nodes. Workaround: To mitigate this vulnerability, do not pass untrusted input to the expand() function.

🔗 References (15)