RHSA-2026:83502HighCVSS 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.20.43 bug fix and security update

Published
October 20, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (6)

CVE-2026-75888 →CVE-2026-84292 →CVE-2026-93017 →CVE-2026-33814 →CVE-2026-35469 →CVE-2026-46597 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:096b7475667a3d9c7e57847b206d2ae494bdaa8e73610667e4c62ac265eb3058_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:217a30198f1f508b308fdd2ed9eecda1316575912f5386c8cfb5e0f98e4c29ae_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:72e6ca76b8d55227572add6185581c6c7cbccb251268de78bd71eb13a1c5d207_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:9a8b6856020a59c38961348b8c6c98546a7f5efbd627304b85f05ba264f39a80_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7a8140adaa10e278b4253e64e93a58b3ecd7206f2674b9ec3469f63e3c6c5e84_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7da74f7b5459a2a93d5b2bbb396260814556624a59b4683d483522b714038166_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:999902819078a3b46910a7efba5103f6aae164fe8815d679724c84842e392846_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:a3dcfe575362cdf5f86429a87b38ab0c3dafe4f2f4d0a197337217555c296fc3_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0bc3afdbbcd3bf0dcaea8460db7aa4e9e69df31344e811672402ab9e4dc752bf_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:742be1c3980b90e5cb7fd592460a2eb85499b0b3b55798d7f650218053d6906e_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:d1ff14859c7d6559fe5c0732a6e837f515fd9f83d8d98eca55bdcb9b0a191f5a_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:d93ec8ffbaa7e6c90e268ac7eb631cfbc9bf4732e88d7f35d856c7fb8e6923bb_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:43862360f64d69083f57a3b44e2a31df8f009e6b274d4e4c2477775ec60c2cb7_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:630223f09226cc9337a14c85d9b37bca4f4e1011e8d364d007d6ba9160664649_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8497259c5eee3a62f67c1451810f39f839e010f5c8208cef6835d487b6f7a32b_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8bb0dde3525f32f1d82780d149effb144ee5f768db4618665470069a6f4b6a37_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:99cd0bfc6c0fedb780d17a51e1a673dc49f59d07a5928c4e48209926899f630b_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:abacee18b1c3da62199004b21f4be0d8306adbfded62cd55ed75ec91776d7e45_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b84bf557ff43125d69d0476fe0ce08f37f1fa2533f65fd132a6d594ab5144c49_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:f69de5d08162b188f777f7f78ca354af480d1046d01908f0c1999fd048a16269_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0f8d3f95c5b7e968da3ecfa9eedf32b3a0bb99a52503f2908ceaca9245c4b4c5_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:66fe113a54da0509a28dd8946e41bfd350dc527e4ded9bbc3c5172e013822845_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:a020439cdd26d858d12ec6e8aa3395d73a709ab5422dc70478355642e3bda72b_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:cb49898a64ec9c96a57cfd23b5b482157ddd17153d70716ad3b7e55dbe72d5fe_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:21004b5dfc5beaaf4abfeb52f22744626236a38f5ab09386cdabaa91fe4d4cc7_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:70de687dc4adb80b92efdd49119a36e3febd3c2137334594548d6690135b8835_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:c3aa3d7bf3409c5d0cd3e4816eea45aa0f28cc75018b86f9e2fa8dbc12fd4791_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:edde365ae822b8d36cf583ceed322299131a3e3851e0f1275010de2d766066d2_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2b86496e5c7aba3ac4c1c7393705da8aae72641da9677bba947fdabcae21998c_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:4b8647084efc21f055060facf77d14bf0e28a766ba176a1b5f67b646113df43b (For s390x architecture) The image digest is sha256:4ab512672ce79fb1ee7e9355acdbacf70d41f54a847dd303c802e64604f4ea2b (For ppc64le architecture) The image digest is sha256:2fa094c5294ca154e3e7410e1353602da4afde6295e2ae31af8adfe6f59646dd (For aarch64 architecture) The image digest is sha256:ae817cdd99a423de2f6426a967e1955246b5d5cd49c20cc1024c2f476ab2fb21 All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (9)