RHSA-2026:89726HighCVSS 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.18.59 bug fix and security update

Published
October 27, 2026
Last Modified
November 2, 2026

🔗 CVE IDs covered (4)

CVE-2026-93017 →CVE-2026-111943 →CVE-2026-33814 →CVE-2026-75888 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9fb50b0cd389a9876d37ebf4b0aaa86283e3b007ea7ab4a16623bfaff622f5c8_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:a8781d17956c8ee97c0108282b147e70587ef107da40cadc637c44f0e3a9d04f_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:afee134d83f38fa26a971ff14de7cae6682ff31eaf30a821d136a2d354b14e4c_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:ec8b0977755549f33ca7453525d1719829e8917c550ce8db6b44ebcec2014efe_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0bd99b82e83e34c89aa4edfa5336a519b01c7ad80d2ad66f624a8938be831669_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:6cc0165eae20d6395e92b953862ef925cd80d8c34790464ff56006d274a81d17_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c390d98f4e93f20c0861d4d5f1c3ad4feef278662431d54d68878d7d53025126_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:ec84cdbfb942f32275e59808b95f9e63f7698f0058512907fbd69e6b56c4a951_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:05abf53194c6c0e564c275707a0723996260e846bd724a4045438e78c62ef9d4_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:3219b106088888ecc294c166a166ebfc4304f1ebf5c7abf5708474f540eedda6_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:bb42dbd68b29dad4676079d3254f4bb010a41482e83bb048391d3c7b5818b154_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:f6e0830978707a9e4af916be73b5759fe48b3eaff407d5e0c825ee2d87d3e5f2_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:51eaade590cdb8849103a2417e931187b86ecdac65947f9a302c6cd366b3b432_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:55e0051802b4f818be68d6a0ee64e0bcfb6e3a6c2e5d773589102b0740e27c6e_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a1296242d1c3728ed24be7a048a3a8d4150eaa6596343e9d28bcfe088ed957ef_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:c656f73d80202ce6b510a1948fa5d7a94f962ab8ef76f95c4905bba259f547f0_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:0f695acee1baccb13f862d217485493fc5506fb75439b8d362bc08cb656c67e2_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:68ae3129b66a726cf260b6c6b92438030bf8669fb978df4d8f1b928d2b7c5653_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c56e88e02f8e9fa0af18536eb9ed67a95e7cfe9523cf950e5b672ec88f41bd7f_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:f602a0c5c7203bb1fd386e8839572d72a9b866e59c9ad350418e19e57ca4fe0b_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0174762bd93f7e424e79d73d8376c2da1f8b9bb9c4de75eb71e68269c1238e7e_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:4a41aa6bf61daa4757c7d5c6f59b93090172dd51b6b76a488c8d4e7ee30be925_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:593aed143f324d339133224f1f209283bd00ab8c1aea6a184f5e5343af73ede4_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ca22e60604f12a193e3d4c6696eab2bc9394aa32cc95e54eb00c508e49502db5_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:0fc167b45a94a26899693f12f3bd43e13aa3ef499626c64b9f4d8301e5f2a476_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:7be080dbb2ef27693b37f8bce39b729ff23ce7be268cc6e1f27c227f350a5914_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:7e693f686f258e7b5e257204fc514e7cc9d7322d8de28614d6cd00d35496ed91_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:f0f5b1fc92cb14baa70fee9327741b90323ccf609e2abd4d24287b44846970b3_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/frr-rhel9@sha256:6b526cd89985b1ae24473ec4942c16c66a4ad5ad82997db290dc76f9689b756c_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:dabe7545163af58a2538c645725556acea531fdcfb83fd5aea9b7f28cd112c06 (For s390x architecture) The image digest is sha256:37753fc25221075037cbca9e1c6f0e14f08f33cc86b668efbd5c1fb5453d7fc9 (For ppc64le architecture) The image digest is sha256:7f5637b4be7768839c338e81312e9deb5c5b6f20a694e72f0746d4245d9e90fb (For aarch64 architecture) The image digest is sha256:22447d72c8c01d104946efa2e951a0c3fff37eb753d5c6ee7cf3ff3615c738d3 All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (7)