RHSA-2026:82785HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.14.76 bug fix and security update

Published
October 22, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (12)

CVE-2026-39829 →CVE-2026-39830 →CVE-2026-39831 →CVE-2026-39832 →CVE-2026-46597 →CVE-2026-49329 →CVE-2026-66138 →CVE-2026-75888 →CVE-2026-33814 →CVE-2026-39828 →CVE-2026-83589 →CVE-2026-93017 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-49329 — openshift/oauth-server: openshift/oauth-server: Quadratic-time DoS via Accept-Language header underscore bypass on unauthenticated login endpoints CVE-2026-66138 — ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-83589 — oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:0cddb8a8b8dc4c0d6eb3df596176cfee25feb16d7daab2183c4f85ae72102ddc_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:69aeb356e2b1b7d7c4fe1b9d9eed8c5eb7e88cd6c15163fa0ca03b2c70b8b0e5_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:a183e9b15739d5d005cf4bc95e7ed29592de9b76ef597ccaa2ee3a81682037cc_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:c739d68ac8499c34d5b1cf132e359bd561281b260a0e671e71e72ca600c2a4f5_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:652e7769ce847004a66583fbf6cafd9123d8a3ee49ef0270a4c3d66c2a6ff4be_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:7ca6ea631874092bc192b3f788f1cce94781e5f7d931cf7abca41054039f46f0_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:84798ac9753077c17043c3a550cf2162f1997871c25fc3ed960650974f2a4a52_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e3b7cf79099e2164c84dfe4c53e13f58152b00480d203cda835a260675a021c1_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:2c7bd495a7a02f18f8f200fd16f446fa85788ed3ebefd330b2275b16e2094cd5_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:2f30d8c1f085388418f5de57fe223c9a8228ee97836962a7e7f0fca137c906ab_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:3a0287ce172f9ff9d0f7043ef0597de8b35f76da7e312d8dfcc6ed75a0337695_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:682972aafd304da9f2e552397edd47d2aef4f89756b9af33e33d8b672d6faa3e_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:1d4f75f78dd15f709fc293c226f02b50164f9197271e24b5bb2e6250e488f7eb_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:43642b97c6984cbce51f0ec16a819f939a8fac296850aef3d9d157c086d93fc0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:70de6a83e1b84266a482e5373bae9cf39b560380c0d3292e4b31bfb2d1f8301f_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:eb89214180bbbe32c60f39416ccfabb4cb177503dbd295f0acad2c4565730885_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:407ede5a2d32f8d39d052a253d4dc28ab1e3797aeefb4cead7cd5895a78b509c_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:4fecb782f5ad475392bd717949b88ca3b579d76732ec0403c020ff7638912579_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:64969105b3659cfc94e507a66db885c917a1a32fd5f25a291ebd6d251ba2a5cc_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:cbad564f41cec5479d4d287379b9a5186e23dabc06018a647f8f7213e4429be7_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:303995124b1201e622038c74769dce003e55426d4c76861c01c1f1e75b248788_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:4b7345836248701141ccce248b60e36760c0433593f55664dd0f4d463b186b80_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:85c5ae9373b1dbe40831918c2a6d1e068696b9388531ed24e0dbdea5ff1e2f70_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:87613d6c58f5416dc7156910e422c31c075e696da3c46f464a273fb7d94395d7_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:5fb2d72d024c8a0fcd48611976c421bfb8861455c6f9199eca8beff283843000_arm64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:61efff7489cc92aa016940f11cb749ebef05f182d9e9e444008c2231d200a320_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:bbaae08fdcaa74103494135f8bcc9a344995968fe7dc848b6bf7dedd7c7793d0_s390x as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:e0c91b1a09634014cfacc305cd72454e9983189999c54a8878fd6df3c0efd30d_ppc64le as a component of Red Hat OpenShift Container Platform 4.14
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:98d0395d529b7b8b35613aef31e561f7a67aa9f2159d8cf2517aa287275a9fbd_amd64 as a component of Red Hat OpenShift Container Platform 4.14
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:24b407d0effdd7e42262b4cc70867ae7699710c30a263b1b9642d3f93ec7e80d (For s390x architecture) The image digest is sha256:70e7004918891a31b625dfdf851be26eb68404d4b1ff731817d115b5c82d217f (For ppc64le architecture) The image digest is sha256:cf1e311b25753a331b8143c710567016b4515102ffb61de169b4871a252589a7 (For aarch64 architecture) The image digest is sha256:6f8d9be80eb5e438be80835c3facb3a43695eefe8ce6f4dd9c61e42caf38ffdf All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Until an OpenShift update containing the vendor fix is available, place an external WAF or load balancer that terminates TLS in front of the OAuth endpoint. Configure it to reject requests with an Accept-Language header larger than 4 KiB or with more than 32 combined - and _ separators. Rate-limit unauthenticated requests to the OAuth login and error endpoints as an additional defense. The proxy must re-establish TLS to the existing OAuth route, preserve the OAuth hostname/SNI, and validate the backend certificate. Do not disable TLS verification or expose the OAuth service directly. If an external TLS-terminating control cannot be deployed, there is no supported OpenShift router-only mitigation while the OAuth route remains TLS passthrough. Restricting access to the OAuth endpoint to trusted networks can reduce exposure but may affect user access. Upgrade to the first OpenShift release containing the fix as soon as it is available. Workaround: Remove the chronyd binary from the Ironic Python Agent (IPA) ramdisk image. The vulnerable code path is only reached when chronyd is detected as available. Without chronyd, IPA will either use ntpdate for time synchronization (which is not affected by this vulnerability, as it passes the NTP server address as a separate process argument without shell interpolation) or skip time synchronization entirely if neither tool is available. Additionally, restrict and segment the provisioning network to prevent rogue mDNS responders, and review OpenStack RBAC policies to limit which users can modify kernel_append_params on bare metal nodes. Workaround: Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released.

🔗 References (15)