RHSA-2026:95610MediumCVSS 5.4

Red Hat Security Advisory: Important: Red Hat OpenShift GitOps v1.20.11 security update

Published
November 5, 2026
Last Modified
November 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-37236 →

📋 Description

CVE-2026-37236 — github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:053db375caa1c8d0615ed98c5bc890a09c843bd88a7a0132c7d92511420eb8f0_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:513b59cded93149c6b1a5f775e7ca86223e50e5703b3866de847242371f38165_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:8b81ad6d9af86474648685ac1555e6efd830a00f70481bb727b374dbdadd6243_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:b16d9aff1e7f730bf9b05c6f712e4baf4cbd7288273ce4bb91f619d0748e7eb7_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:3b500558a013a2e6fbb5d2d7e43fc51c22736bb0c772c463a268de8585b1f8db_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:3fa26ffa000477ceb045ba6c651e03ba90c48db471316fa2f748ea52970ad2f9_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:5ff95a935d074011ea700c455d4a39e1d89929b3b49441287882fe8c37f9af9f_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:97a9ca01059bd35698c6a5a3f3ede1c08cbece7829da0a6715c7a90f8c531289_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:055f0554cc3f670bcbd929b2eb5c41e3d7b81159b3db751f3905531294ed5187_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:1d3916a7cc84a57c757ae064524cce3641143831b95f21514b1a9740a5f520f8_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4e03dcd293873b685e9a14d36b400da3ae3005f78df71bee91420873f7ab4958_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:98d503814e87fa82e9c8bc703d77795df49a22ff1cc67b44d8403f4e5c06de4f_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:06c05f6c82b8e722f85dfd3f7c0aeb0be65542da8049f9e7425246b2f309ff91_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6ffe487ae383ae9d226bf42623972f8e0f941a7b71af47b973aafc583d4ca2d3_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:b29f8d41d693e5ae653ae72dd49654d8c1fff22726a326b47edc663797c93df2_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:d7d59dcce99c771fd59a9aa4583075d4aa81a41de8fbcce7ae86fbe1b5d9c0e1_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:0d477499f59add73be54ba9d44712fdb834f992a1f1c118c9f0fdd8ad0047b36_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5b5c0c985f30602f0574bfdb9856c1bc2008cda4c02ed6f6042c1213ac895ebd_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:67d6ca4cd22fec82a30aebeafddb50025a3b5d144a3d612c4656f409d1db07ca_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:930f8239f6b4993be505e04ec50cb9b9af0b1487c8079615bcf0ae3bd95200be_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:24db8427f5b4525d03d5e40f36aed2cf9d6fcb96a6b33d53455773e658a3f886_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:369cf93f80f7363f9d6fb1721f8e71f65756f1132662205977f08eeed0407e3f_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:3d774d4b63e2d1232fe49d4bc45bb23d3fc78ac7d05cb2a730f13df48ee3ff02_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:87e707a3db102cd68fe8223ca1b88048659784226448f15ba5c731848423bd57_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:1a96863be025da65d40f5bc7896d7366fa2c3f9b7f4e8d2cb30343897764aa92_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:5158f0ee5457c5ea9bd7037959011b032023529e2cf082e994f1d03b4fe0a284_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:7eee5fa26d8b752a4619db3a0e7c517b6c1bf9312b8da86c6b820d0ddf6559ad_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:84b441c8547983dace1427e9bfa963818c75729469f27a491cade4188b6ae1e8_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:b252728e0504d8927ad74383ce93b054b693e3a257f5f37e8693adac984128d2_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the `X-HTTP-Method-Override` header from incoming requests before they are forwarded to `grpc-gateway` applications. This prevents the `grpc-gateway` from processing the malicious header and bypassing access controls.

🔗 References (5)