RHSA-2026:77639HighCVSS 7.5

Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.7

Published
October 7, 2026
Last Modified
October 9, 2026

🔗 CVE IDs covered (4)

CVE-2026-41178 →CVE-2026-42151 →CVE-2026-42154 →CVE-2026-42502 →

📋 Description

CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering

🎯 Affected products35

  • Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:5867a6765408efba2f8a4a5f06a7cf3a108b7144074681d437254f88cdf8d904_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0cdf057b90ab1a06b114c1d7eb684beac325e947187245757e600cf6c8d695ea_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:1ceb575d48c09b784ca8ec3b90154344f88e62aa3c737223e57f820b1eae93f8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:229cc5581673229756c23afed9faca1af773aabbe714995471dc0b0675ec5109_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:85ce6360373096dae5338fd372359d186457b583b8c403b84741f59ac2e926d9_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:2ba6fef395812b97c1ca3bdc812550b84008d8a0222b2a0232800d9420e0742a_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:51825481204047d89d21c390c369f60c2d7c6f90d1b9688b249eef79ec8308be_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a2b5a0c0323b844fcdc09360603c6f2f263cd391c012461de71a951cec39bd0b_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a5cdae5033367bd2dfb2afe58b141eb3b081efc8ff08a92ee7baae9493673eae_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:6e05aaa40d8030f2d03959c5b828da2d6630d770052fb780f1493c7f0f127cf3_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8f92a06f20fece433448c93d337f648dda47340114ab62076b604134b7dbfc03_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:e9dcf615c12e91f47b951ce8d231a1a81231ecee294e88d926890bedd6e2546d_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:f1ceed7fbc7bffbf4799ebef749fae87bcf1acb265367299bbd771f94198301f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:07ea5a2c3d6a85f2d9b4db461f6d0709e9b041a2478480ab807803970386660d_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:899870404d2aab5cc3ef06159f1c3fea6ea11a76d3fb6c266a28881a57a84af8_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:cfe363b8dcd6f87cb6ff16fb1deab90539ec611712ed47fa1cd796e38ffa7dac_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec0a79d78677c143d5bf08ba24ce87e06b97a4b29df721276170cfd3ccd443d3_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:140282663fbcf4c0bc14fd5928cb5b5bf395f152e0bccea6c024daec038cb1eb_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:26b899f654e17f0e6fae80859a4455efed141a5db62a9fde2dd1ffcb57eda396_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:2c2c98561106ba1395ef994d0168860e8d5c0a16ffcb2bbaf9de30afd2daaee9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:6ff7218557873037213de9174025674529cfd4d476e2214251a4e6698fbede7b_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:8b4bf1cf4db332afaaacf4d6e8e02d3dd3257c6d3964f1d1de63acab62bfa282_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3644b09eff92d9406079df144b8083633c0218c3efa48d2411a1b18627b5e9d2_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3a74f0ebba75ca491bd357a8f5d2e02e6b18508cbf426253e4654cfc1530183d_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:8b1c4331b5b8b0eee432af830a11f6cf43d9699d790d09c011b2b1a02007ca13_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b18585062c47e8ff7cd973bfb0faa920aa85608501e952e7b053d4ebb337bdd4_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:762b5776f1b31474e4052204e7fe7dce35b44dc8756b9d4078554d7a2c0ad6af_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c21fc4fc18a3cd7bac6ef26b1ea5678277e768eb0df9a1e9567396cad4290ebc_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c90304afb7cd803c1fc0749696850360899e705ff3ce5fd8bd1228135412d6a8_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4
  • +5 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes For Red Hat OpenShift Logging 6.4, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4 Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

🔗 References (7)