RHSA-2026:27009HighCVSS 7.4

Red Hat Security Advisory: OpenShift Container Platform 4.22.2 bug fix and security update

Published
June 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-46579 →

📋 Description

CVE-2026-46579 — openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:18df7fd3e5f294ca348b46f27c802b7522c95e79ca935610a3fafcb0f1fc4a7e_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:1be036f192f0159999fb17d84c32fb82a872cf1242b9e90f891bf22fc877cbe9_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:2bdff794208cf313590efa68cf8831e8e0c4943828a9fa1fa0752e4933d54e93_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:db4e747abe9ca653fcd3bb02dc07d20394a849cfd936bd85985d421143fa0e2c_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:3aced0c7554ea3fca5638e0f2dee52c99cc03f7fd3648cf2e060310309245d06_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:475a8869be93c87f09b09eaf90e237980ab6a6a6c083fc1f5f9e70715582fc68_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4e7ee2de25199a89dd3ded7bbf8901c3a0c15ed6aea2e904192f9190b94e0282_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:5f387ea12654e028acdfd5cc0ebae5b52c803a3fac4537c770c50b453801c7b2_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:1a503329bb51a7e25157d82b91fcd8b83792e442fbe18c412e7e2a19b76934f2_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:5bd235f79ded468fce55700a3c29c591636d60ff87eac2c7f012be1bd7b88e05_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:81a7f07fae88b8bbf7d6a5703cdb5407ec811158972f4bb37d25953ca56559f1_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:a77a8aab71f5f1211713696e32094aadc04cba6904e2431f6a97c0744b8fd1b4_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:7b460ec8c07785e74174099608b59ba28960efbc0023cc32623d838283b755c2_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:82248a34da551deac21dd7a6ba16d46d719547170a6a2f070d484b29409b1914_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:a5811b5cc75e42897081c7d94f38b59763ff28104d10ec5a215ca57a3333cf96_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:de7d0563e68fb89001513e129d57a5b2abacf120946c7e1df5c967e3af113ceb_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:98a9ea8e9c763e395d8f58ecbf0b4110dd452347e4aa314fe98ddf67e8de7d77_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:a09e57caa27abc6e94d2891ff8fde76aea6cb5c360227a162a29c696f2dce2c2_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:e1e5e03c11a3472e66d1c609b7f8bf43bd0362e28ef136f1104e1e8bfc7336bc_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:f3a43cb120234d0c3d1d870f25b14d92b59e83ab5bf7301ef43945e46a8f88f1_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4150caf8267cc55d20dfe2730dfed2425ebff3463fdc1606436aa53ff684bc6b_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:a00d70ba0b4f7f9c2c033097c0f77a05b231127efc0353e3b0b8b78a416aed8c_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:b48f5412d9b0cd94de27ddbe057380491154b6a2db5d2b9c574ea0e65149dcb3_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:be2ecd7e4cdeaa2dae3aa59be8a88b5c5830a1cc71edd7e85585f2f3fd1cf416_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:2edc18678e3c831ce2b9a4e196c05632c135485de18a9af363fab0bcc824b168_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:5d52c3f7f37fc458af60e30754206d4ce94d4bbf3808b682b9c3493928c8ba67_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:78204a5a40f1f657f6f47c6f3729b981aa38daa7543fb4c26f53a4093d87f9bf_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:fe0fc8c5bf70cf96f428840c25220f1cd5abbcd45a82b3817c89ab2c9641512e_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0abc641392d80eb33c1919d95a79518907a0e9b2bfd606d2eebd36a54a3937b4_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:b5fda8b45cab25b4d67b214e4f802a858401367bfd1f30afc77780872a626e42 (For s390x architecture) The image digest is sha256:71e083b1c59bafeb1f942ae916a645f864d1ddc6e24ed494fb91d5a33d253bca (For ppc64le architecture) The image digest is sha256:3a72d899b7a3bc7b3b630b1803cfab078882150954611ff03e650a67fb62dd10 (For aarch64 architecture) The image digest is sha256:9aa06608263d6a60225fcb287ebcc7d8e9614b176aab20b7dcd5ca80528c9404 All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

🔗 References (4)