RHSA-2026:83702HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.21.39 bug fix and security update

Published
October 20, 2026
Last Modified
October 21, 2026

🔗 CVE IDs covered (10)

CVE-2026-33814 →CVE-2026-34986 →CVE-2026-46597 →CVE-2026-75888 →CVE-2026-84292 →CVE-2026-93017 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-42502 →CVE-2026-104795 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader CVE-2026-104795 — insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3b9cff6771cac19800c048da72a957a5f16aebdbf06ebc43317d7225555e4b90_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:5b5b89b70282920aa5a079eedc6670b78596ae4f33f2d63546de11e5a98f9acb_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:68656f55847118722ca35e43b6f62362e0c7e92a91c21a65889ddbb26fcb79b6_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:b1629df6645f0bdb6cb94f243d577637e1a8143e07180c8543fee19ca41328dd_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:385f32c1ed15cb6084e1bab5bafad0521ce4e97c0a19aa0e045ab20f715cf000_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:41211ea8c31853ba9e0f86e980bb0762241d039fdadc8b534c2d951fa6266923_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ba541fa2bc4d7b23041cec947ac3286cb7f42a05470ca2663253e133e65d8630_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:bd96094498d0e638136bb55f5f36804f15ca8a173331e36792c368d477923b76_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:42fd18092d128c4fa9a4647d9d87177aa66e38f92c4a7418ffecf4934b905c97_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:64290f05bb1dd246fc6715cfcb3bfd0ae4f029b41fd67710979a38dcfa39211d_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:bcf70645299d60bdcfc98e6fb5edf62013954542707cb48fdbbd3e3ebd34fcae_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:de6160178262f9fca4467aa4a5b525e01361b7ce97da077d0589a055f985bf1e_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:443672e552c80c984dcdbdd1c3927ace1c40deb4df5dd8394b943f86f8717ee6_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:62aa9a0e006f7285f2d3bdeb7e212c3126a43cac18b25710dde84f39fc345599_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ac5d914f0d0b2e5444653d18e2c1e6d881bdc7565a4799e89809a614a5d9a9be_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ed3615d8d7efe7ae31af4f5903bc6c8a61127a80f8127c974707822153bbdf31_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:1670049d73cf2893ad8c4c91ce08da9568e8402f70ad7f0a2fbef44f7ca66d43_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2957e9bc1824485313ba80ee74c752feb2aeefb76b54ac5fb91194406d0b49a8_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:2e40e6dcd007a5325577306222f9defbaa22f23a2f65ef8672cc1f924411a52b_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e853fc30ad182a3eb71b9652d395d8ebcf7a590b69bf44cd03d9566bcf97c508_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:02b555de0a9bef45674fe0048fd05f8bf2ae83de1db32c8adb15df23d5aada90_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:21fb0d16a7374ed53191ef88c8a66d768092665ef6b1c7809c59ff2c4e0d5984_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:34ee73c52722e5cbacc24b213d64a516b0471d8cf93889257c8934c355a3f39c_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:6ff8700a13310723f37672994a22ff2a2f957f6984e1415dcb1b735436ba50de_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:230fb420fe599519e1b2cb776acadab6efe71d411ba7939398620d145bb43107_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6dfc38a0fb6a8907519d4b27994251f121cb217a83a05efc6d45edd53162442b_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:72e537c1e7b9e49bf9633b0ab94a96db16c81f9231d763f29a767a37198520d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:eab4e90646008bf5fcd703a71c7eed09213653b2de8b49fc87895408e02be152_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:53f4e0c22e15faf5639fe2d7e97aa5a89364561a509096b4b0c77dcf1e375810_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:013f4512c7bbbb61f9490824e6997b451f2d4355013d8db4ea21ff4a03d72951 (For s390x architecture) The image digest is sha256:3680c07d5306658fde57a12faa943c6c169be8c9f5073eac84820292146db81e (For ppc64le architecture) The image digest is sha256:0a3ef96195657bfba3130017c6d7a6833fb9fef28c6650d7622e587d20200ade (For aarch64 architecture) The image digest is sha256:1ffb62c69b1cb292b94b66080d96f79ce7af88ecf8c3533a8b76f7c8ef9aa1e9 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: The vulnerability requires a code fix to implement a complete privilege drop (setting all three UID/GID fields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`) before executing any fingerprint binary.

🔗 References (13)