RHSA-2026:23241HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.21.19 bug fix and security update

Published
June 11, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (3)

CVE-2026-1784 →CVE-2026-33186 →CVE-2026-34986 →

📋 Description

CVE-2026-1784 — ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:17408f54d2afb09ca531693b18261add8a827cf7f9afdedc612aec1052e3d59f_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:407fa5b3937d7e1bf3ef83a31de963555b2719ee19a45fe4a30bbf04a9d89330_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:cdd5cafb5ba514d34b5396e19464738ea7cb4ba662e183f15c8c3a113cef740f_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:eafe6235017eb45baeeaa139d9b709b09a437129372a5045cc8895b28145a58d_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:1b3314f3c46c86863a6bbd2b1d7bc61a5fbfc634581dfc750c7e0822f16329b7_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:3c64e822e5aeb9d63ca880a8143e9bff6b76dd9dc5edbbe8cf43cc5be3a46995_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:594fb9232dd4a3fba648af5741db04a7d102f6ad19cfd276dca191c3af156914_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c8e891946f9df185a5077172a52f83e55f10c42c95d8f8dc8ce803ca37816fb5_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0039d5aa7a97404185e81107bbddb330b1b94ea0c2548f96148d280b3cfc58df_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0c20b09ff504c526a64bf50e04315dd5f19f718eae6558ec59417208a8c6a1fc_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:131d96dbd856b26ea4807801112662a1180bf78921a4e05edbfaeb7f68028be5_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:7d0c9884002bf287d4135cb8ba681226d9f6630ac1d3be5b6c2c0f938693b0bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:12843195f50a7cee51c9a6973e777e69ba31e580271b24b092bafee83b0aa74f_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:1b376554df90f4a4d62b28e9b3818eb2e5cc43b4b17d69435946bbd8001cc5e9_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:7d8364af051527cd68921ead67e1b6d29a9786771160c7744e9d0a3c4cf32619_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:c615e4cac78f1f2b13493a591ecdad03a6cc006c311453c14fc8f6746a68c288_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:102b3c552096616499f77cb1809980ff8e20b1759c96cd1d580348f6f1851068_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4aa4ea9828f5882549c13a229101eea6bb486bb5ce1592515ba3fa10609a71f0_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5c0b9cbc49e33b23c14ba7ba4ae668261e33f0fded127ad7c89f6c84b6c3eb7a_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5fb6ca2d3dceb1e0d963d4916b417c0e15a720b016cfaa3f24ac3cd19d12438b_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:27d9c2075a202aa7f2450047b9feb5155324c181a7476f75e1e7b75854b1aef9_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:708aafff24a8b5554a34d97b35fcc3960aec93e1ec5be6746623c17c2edc3d2c_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:730ba8dac30502f498e8fe0ed140377c4b30c0c6eea99eb69a8a7e22433eefc3_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:a00ea252ec5118b50d43ca9ff0ed6044ef538f07c4a9b0334414555aca422de2_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:86231cc8acbdb2ccf6be986d998965e9f9d028b2023738b78863a9be202957ba_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:92b82f0b125bc503b4fd8c2a1b45b2d61fb7e09cad625a34a97640c9b3e4a677_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b93e4ddaf1968b21fdb3081853f43443f7bc8ed80339dc1325262bb8c4c53687_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ee524fb5a3cd1b423d006937dc2cf99dc4fefb9892632dd4c9d0452c21a07d05_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:132df2044bcef27893d195cd2c670ff4a6ae70b35440a66fbfeec6b2ab455811_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:1417c1970881b2a3b8d4baf2bfed9afc8be016ed82a86a2245fe8c683a82ab33 (For s390x architecture) The image digest is sha256:713c99f6f70ee1297892c4920860ebbc2dc981e22273bb3a6aace5dcc1e28699 (For ppc64le architecture) The image digest is sha256:d35c97623e5b5e1c43a4f27de6946831eaf892584dc25f5675cb0a1800dd418e (For aarch64 architecture) The image digest is sha256:ff686a31f4e7a8d8a495bd4cbc344d35e9cd6a3c09cbd4dae41e12caf8935c3f All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)