RHSA-2026:27044HighCVSS 8.7

Red Hat Security Advisory: OpenShift Container Platform 4.21.21 bug fix and security update

Published
June 23, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (10)

CVE-2026-44486 →CVE-2026-44487 →CVE-2026-44492 →CVE-2026-44494 →CVE-2026-46579 →CVE-2026-34986 →CVE-2026-40895 →CVE-2026-44488 →CVE-2026-44495 →CVE-2026-44496 →

📋 Description

CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-46579 — openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend

🎯 Affected products87

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:061015f468b484041f552ddb246024c4b1475aba2be6b5ed529fdb5a1f2e323f_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:b96ddf35d0e8a292d986e81420c93aa885fc455fcaf616a915491095b0caec0e_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:e21d39916b8a2d702c5adc1bcda18c7b6ddd3a9cfc09864e82c0cdf5188b301b_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:f31992f179936b6b55311d2c673b09ed29a27baa8a28ece8859d6d04d09ad81e_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:989ff868950ddcfb8dbc15092118c85476be437177b29016e3d6e148c5523334_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:b560fc8b23c8d1a7e362ffe84a26413cf5c5be7bae673052f035319f0e76b188_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:f1cfd18b9ae0ca40e40e0f941ae8d3215dbe7ba51e2bbd32310017e70eccffa5_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/network-tools-rhel9@sha256:f2031994576d4640f55cf0febf09b4f03ba9eaeaf433c1266a636a1fe2357de7_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:323728d967c18ee9d1c2aa15b1847d0d27cfeb23f75a5f9fa25ae469f35319cf_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:4b96564bdb684813b8fdc7f0257f5586bd3f2f15fa53afaa3a3139beaee71617_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:aa9d5a87e03a61bb8cffaf75b1ee9db23fd6232bc594e1b1152e796083778edd_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:ec6e3caaad9567c2c0e423880f2e7b15f45c8596ee792b784f7fcca05ea28f66_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:6bdbe43aebe603002314b78857288bfb37f5bf8cae3a96d0e6b378b53a277312_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:938e55ebf1d2297f018f1d67c0105d874c524fdbeb587b7f4901b06ca2e3be34_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:99158d48956d3c0ab7d7199136b2c342c49daba19a91d2755ef6ea42c3e23bc0_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9@sha256:9eb40419d902bbcfac7032918098adc7e91db26ebd9a1ecdf294626352d5c4a0_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9@sha256:14d3506a84c56ce94db20e3ed1763deb9f72d0febc1a7bb2c8c8c6edfb30c9cd_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:08681a7e9dae6792a5897594769beaf151bf52e489378a133886313f8dac398f_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:3fac643abb746b79b89a49fb5d762adac833e3265b83a832cedb3c7254ab6518_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:bd26beeab9ce22eab5cde362ac3610fb83c24d5525075363c50131e8000eb5e8_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-agent-installer-utils-rhel9@sha256:d0095c609b0c0dc6be36865e426e6c97c1793e282ccb150daf5eaea326cc03db_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9@sha256:387e994a39948184388421bc4e2bfdfd604ebb18b0e3fbb209b256ac03cc944f_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9@sha256:865891f674c073eb479be00ea69d4a24546dea11bf1e123b3358dc0dad2836c6_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:5d815836e31186ee2438933286395b35c6043986a1c55496f6314dc0aa796ccb_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:677b973d8853977b513318ec5acc866a8ff7adbc6c27f02e3f2b3de946104d57_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:98c8e94df91ff429ac6b104ac3fbd345273f0bcdcd929f2e38bc64aac6c2b1fd_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel9@sha256:af29610cf522f1952006878a267b7bc8c624b0ba975da5bbf8c3b84c23c72d98_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cluster-config-api-rhel9@sha256:14b84478be017b16f2c699ab6248450a9f8862313fc4ef38c23b5ae7bbbd27c5_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/ose-cluster-config-api-rhel9@sha256:155201b7a38a18f69000651e3b0ecdcb19815fb0bfe2f7971b7b49b7a626ac5c_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • +57 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:7224f77afb20aedaf82bfc13ca11699689bd5b06795d6d1740dbd4c265150c44 (For s390x architecture) The image digest is sha256:73811451efed403727e561f1ffadc1936c71bbefbae526fcea86a88fe23473f2 (For ppc64le architecture) The image digest is sha256:05cb0b4804507c0b5e7923b7c6bcf293bd4e2d0f476c8ec6d13b179eb3157b42 (For aarch64 architecture) The image digest is sha256:fd193bcd1042c3f17c33e7668d7b9866b915ac07075e6c2e35b0fe396bfd9a51 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (13)