Red Hat Security Advisory

RHSA-2026:48676

OpenShift Container Platform 4.20.32 bug fix and security update

Released 2026-08-04 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9

Fixes 3 records

TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

MEDIUM 61

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 4.0MEDIUM 6.3 Network No auth User interaction EPSS 0.00404 Published 2026-07-14 Partial fix · 3.4.6, 3.4.7 CWE-79

TI-2026-13581 CVE-2026-16242 · GHSA-43hh-68v6-mf36

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

MEDIUM 50

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00918 Published 2026-07-20 Fixed in 1784905766, 1784945966 +13 CWE-306

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248