RHSA-2026:70647HighCVSS 9.3

Red Hat Security Advisory: OpenShift Container Platform 4.12.99 bug fix and security update

Published
October 1, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (9)

CVE-2026-33814 →CVE-2026-33818 →CVE-2026-56860 →CVE-2026-75885 →CVE-2026-75887 →CVE-2026-1784 →CVE-2026-9277 →CVE-2026-56859 →CVE-2026-56862 →

📋 Description

CVE-2026-1784 — ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection CVE-2026-9277 — shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-75885 — openshift/console: openshift/console: Unauthenticated SSRF and resource exhaustion via devfile parser endpoint CVE-2026-75887 — openshift/console: openshift/console: Unauthenticated path traversal in i18n locale handler

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:09f111e2253acc3f1d24f67808a0c1fbc96683c553ba3afadd1c0ddae9d5ca75_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:3cdefdb7e2b3eef774ba0cedbd55f79afc1f68cb08efe11884218cc74a32b24d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:61507059a20084e2db6c07aa90b27122b2957eade48a5b82f0443c19cad14657_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:64df90c13a5d9420422a29e8535f5c2e190acfb8ca540223af09bbcc4a1cab0e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:9b7906ccbce1978a6f5e6e731ead15e427ec7b0ea0dd6998fa625b2da732f66e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:d695bd8293387d81caa930399c7c462d975b3c3efa1f7da03001cac149abe700_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:212bb8c25f3d89938676ea25bc1002ac2d38597fec93af2c0504c709a35b12a5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:d262fd7083042ec305c78e504cd1f44012a302668ab4a3b8f15c4d30b54d9368_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:e9d6a2ec43e5f382e3a04a25d6a7e0d62256274f64f065c8bc3dd04d6cc42e4d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:f36716e7323890675398d05e2f36c71ef648257dac160725ada1a87d4dbb5683_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:68b07e638669f77d93e75876ee7d34fa401f010da65febeec454a50f75bc0484_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:2104743c2745ab6417f8f7a2083b7d73c5b838a4dac1c07ff0f83f5293e87a6e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:a1e10992fbde95a0ab3a6674cf5da916390e0003d04a76fe2e21fa984d358ba9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:d018efda3e57c9eea52cad5fa825134bdd58751aa219b7d8432f15c98acf1276_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:a98bcfca69a6c7fc2d5b7d39d60ffcb5b4c97549ea54933dca75f91aec3b75fa_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:41110013a15450b375873d5300f08bcfed8e537fd8e33dbbe509ef58497cdbd4_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:0e76bc3ed2698db4c1665b69971ca3be77bf0be62a5148a53d79c5c9268a37d0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:d880685b772770d0e44893f6ba9a164869fe25fbd92c6f78fef573361f76b07b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:1324b1ce3a47ca1906b93e5d1adfc6fc58be8a0e6f521c79c2a415419bcdc9b1_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:1f1431a872420b80b01cbb176f9e697dbbffeb0494cb2053c38472a12e9937cd_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:06f672578547a5c048674eff982700e241b1e571127b315b1d889b4997457ff8_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:34e745dc1bec43d7f34575b58e6c1ab0cc2718bf5a51b8a2db89a6dbc58c54df_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:2620f4646ebab93c61c2415aa34415f79ca716de1dbe617e2b2454dda88b2412_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:49cd4b061833ec03cbd203e0472c48d7ff73a6c0a887e308dad2609a22e1ddd6_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:04d3a2ab9bcba4bfd8c9c304314cb0b31dc090ba99951fc7dd4c40f15033ad00_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:ca31cb6de6aba1e853ccdd270789eb6c32f9d6875c27cc1a1402be05881c0e7d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:18c05637432206e59235a013c82bfbf6803d162d143dfe9ce5391154ded57b22_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:c84c9e53f65a44a2e8e66a13023ca8f58baa0068cd84942224d2db1096d69e5f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:175f2200383c63ce6cb8cc46be4cfa00cce2582482cd59607c82906c62ec0a0f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:387c81d0f69383a8f333dbf2ae27b11b803bcc6005ade2ad3437ff26a82a816a All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)