Red Hat Security Advisory

RHSA-2026:29834

OpenShift Container Platform 4.21.22 bug fix and security update

Released 2026-06-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9

Fixes 2 records

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

LOW 39

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00512 Published 2026-05-05 Partial fix · 3.1.2, 2.4.1 CWE-436