Red Hat Security AdvisoryRHSA-2026:83702
OpenShift Container Platform 4.21.39 bug fix and security update
Released 2026-10-20 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/insights-runtime-extractor-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel9 +25
Fixes 10 records
Priority MEDIUM 40
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00663 · Published 2026-04-06 · Partial fix · 4.1.4, 3.0.5 CWE-248
Priority MEDIUM 40
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0084 · Published 2026-05-07 · Partial fix · 0.53.0, 1.25.10 +1 CWE-835
Priority LOW 39
The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting.
CVSS 3.1HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00183 · Published 2026-10-14 · Partial fix · 1792771524, 1792849665 +2 CWE-250
Priority LOW 39
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-704
Priority LOW 38
fast-uri serializes the port component of a URI without validating it.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00239 · Published 2026-09-02 · Partial fix · 2.4.6, 3.1.7 +1 CWE-116
Priority LOW 34
A flaw was found in the OpenShift console.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00438 · Published 2026-10-12 · Partial fix · 1792976642, 1791842061 +7 CWE-918
Priority LOW 34
The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every na…
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00446 · Published 2026-10-08 · Partial fix · 1792974936, 1791842870 +7 CWE-269
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-05-22 · Partial fix · 0.55.0 CWE-1021
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-05-22 · Partial fix · 0.55.0 CWE-1021
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00223 · Published 2026-05-22 · Partial fix · 0.55.0 CWE-1021
THREATIST.IORead the docs