RHSA-2026:21658HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.18.43 security and extras update

Published
June 3, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (8)

CVE-2026-29063 →CVE-2026-33186 →CVE-2026-35469 →CVE-2025-13465 →CVE-2025-15284 →CVE-2025-58183 →CVE-2026-4800 →CVE-2026-22029 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:0bacd152bb8e069bf989d35c5e3d19c7d2a7caa5704fd17911afb8e24505fe74_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:0bc2f4f14a5a2fb5298242cc8b05366782012a08200b026ab4c199cf9322fb5a_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:96b15349f15af700fe522049aa81fc1d7f608eed473a262d103cde9e62c26605_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:ddb46e2a154dea051204213a2992489839cd412436ded9416fb67bb33c2723d1_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:12fdafa4162e087e237771b0ec8c3392f1106b8c5290229639317c6b53f5d83e_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:28dee60c9e4fcb3a2b739142a3cd5da70a02ae46a3026c3320f4e7a944009ebb_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:7820ddd5a82a30ab9ca25a8e2b2c8d8e0e09612a02090f5a260cffdfc3e97c38_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:7b41e14074e2073b34ad74bec5642c36f3f2b90e3caed34d5327cc9d90b61d08_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:76ed86cc596ad718f9af6235d3fcf83470d8de0238fe03d2f3fd9e48b218429a_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:b79030a66c82c63a65f898ba30f528e24cbafe7206e2a4c21b286763af768821_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:cd8517f6945677dbc0bb8fe8f8e2f49d075d4f1f6f5b94a807761eaaf23cfe6d_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:eadc66249cbde612c467d3185d98e9615d0be77b4c1159fa8d7d10bc5195c5a7_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:2da0a4f5fe314ab982c7bf39915065ab841510b675a6b322522ba63248fbd01b_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:2e2224824503d12e1c34460aabd22bd6f471bd6ac26446124b674e7d434e3b72_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:97ca85e0ecda62baf09d5ac553d22f1de1c6e34cc2ef912659edfe597c012bda_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:fc0b6db747ed6c69a488501006e836db38ed58368bb39f0a03dc362e6362ca60_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:6991c491552dec9afc62e10e97ddbf1dd0afe9cd0c5458801567235cb5cd12ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:69ae141aa20c2fe9ad78f4aff4d04b829c349ed7b503c3af9b4945d16c5e3139_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:954e2dc06a60de03d67adb1ea0f816a3e53d1d958d1260fb25c64dd8bbbaa681_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:e2136255544aac54fa4b8bab1a1f5368f3b52908eb631d2163f5de466babdecd_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:07ddbba2998d63b6d9f0c4a84eda9c372ee533755c83f294b57743d0b91801d2_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:0e19a8fd58078d2b54e0b76585067a540049ee570cd393abafc1805bdbad8eac_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:7d23c3dba6ac082bbc1c70f31240891696dc531bf4bed27fdf66cf5c1e460def_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:851e3a6747ba96df7a140896909301fc34e646a4e5cbc180ff4bf89b4d5dc75d_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:023d6b8debb4e5a9782b6fe79fd8c25f8413d76264233a876a134bb2594c5076_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:1073d9f07922d1e95986922b4bfec5664a2bb317298f1806fd51afbb76cf5457_ppc64le as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d7f5765429909858d79a6ca4aa66208d5edb1a07ff35ff178d0c6668da37128d_arm64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:eef13365a817b8ff922b717f409adb60d5ae8440a1caea467b298d07f5eafaa8_amd64 as a component of Red Hat OpenShift Container Platform 4.18
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:671eb9ceefb93853388c8a24687575ae684c1b66b27821a31262808bee82eaf3_s390x as a component of Red Hat OpenShift Container Platform 4.18
  • +170 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (11)