RHSA-2026:3402HighCVSS 9.9

Red Hat Security Advisory: OpenShift Container Platform 4.21.4 bug fix and security update

Published
March 3, 2026
Last Modified
August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-22797 →

📋 Description

CVE-2026-22797 — keystonemiddleware: OpenStack keystonemiddleware: Privilege escalation and user impersonation via forged authentication headers

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:06912c1a3c110ee4cc8ef5846efb4c0a978ee977f88c0c590184574cd4d9f86e_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:4b564cf736741b34aaaee1f3eedf085d8d5f1e47495cb08aaf1d048ddf05e396_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:b64a5361ec245910646d0fce68b63616a25b86cdbfe4171de25ef158810d23ec_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:e693b341a14d0ea8d886f209ca971c9c8282bd6afd219b935c20e0a3814dfd68_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:6b28229889069eebe00ceb0560c9bb7861d6e358e5a5f8c985d9cebfd28e0af7_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:8320584946a2f5f1e5376cc82f52a28701397610d8d64d4d19e11814004d9038_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b16ec70ac6adbe7581d1923974846d0a234988b8480c5bd565e6f2b0483ed6dc_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:be9879761db870fe67141f1da8727755e55bed5188a902298b96c703dfad4929_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:0f06a100baa3eb323e5ee480ee0da46952a514db3b2c30d9d4a1a09224b06e7e_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:3d3826d1209945f2adbd0eeecbdc7df9a44d06fe95011c5b58cbb113ffa191f2_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4bb5f83738972732a8cff0cc7358284648dbd1ce59320c646885a5efb6420898_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b16239b8a663824beb551b68a27c798eea723542bfba427b9507f99ea2e60c4b_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:5732ba6fe7aca06de6bcd563d159ac28cf6df2a3a6c539c3eaf8859eac7b9829_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:acc7af76ca3f99d0a9b4fbd9667bb14dd0c602c279f0b7d918625bb1e1cd6556_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b093d463cad3250f6af890fc2909248dcf4ce48f1f149ed19f1a98c469a3547e_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:b800964d5778f52ef9d7d3c6bd3c398a247a21352e3c66ebb0af72febe6cd8d1_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4b1e957913260672cbb31efbdd3a1ba86d55a98a779d2a8e72696cd10a3aabc5_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5a9782cdf7236ddf18cd95585ead662d617f12508ea9e869e7c81ed1b1ddc3b0_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5ac820837ac445eb8c7de2d7025b19fb227137cf144bf59b3073afc0531f41f4_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:6c94b7e80e4acd8d1919ba8c7299d244083f79c21c43ca98ecc987b4dfa7ed7a_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:467ada945f75c907e68994cef067047fc383b86614f631b50889ff2874b46354_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:7b7bbb9af939d51d4a2b1bbfd68c43deb53c949500ddc377fd036687a22426d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:7d1e59ee6638deded88d112d3be0ceb2b69feb4fa7abd91724bbbfcd8236fdd4_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:e6430f7a39226961c2e5e31e9661619c3b5353afe3d81d153a723feefb6a564a_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:42ec845f540751d8bc7d2f7017e7e83ff4b400123e34c3bb0c152e777fa376aa_amd64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:5357d8fd9365f9f595cfcf9adfb0cd9f3c1c44cab735455619b9c9160bf3ba80_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:6811d997d23817b0b097ccaade534dc05984de4744cb336ef83224d970f95641_arm64 as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:dbbecec608af876e2642eedd40870642bc2375537417a1a50d351e43274976bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.21
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:35720210c998b221dfe4a9f897de0664342347910b1272345929e6e58b1ac2ce_s390x as a component of Red Hat OpenShift Container Platform 4.21
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:9caace3e8d9da8537d33091eaeab307db47a11fa17d0c7d872fb19b6a9808926 (For s390x architecture) The image digest is sha256:49a0680c960e2826676ba1f91e3eb0a908847d3daf00b1beafa5b261d668d03a (For ppc64le architecture) The image digest is sha256:39c453c24bf8d2012dd06b9c1a511b86ccef1f6b680ad5b475e5381ce4518652 (For aarch64 architecture) The image digest is sha256:8e5a7eb8f2fd6831b6c229fac611ddd6d00713af3d327d3d1d93768710dbc7b5 All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

🔗 References (4)