RHSA-2026:89198HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update

Published
October 27, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (8)

CVE-2026-93017 →CVE-2026-104795 →CVE-2026-107176 →CVE-2026-111943 →CVE-2026-33814 →CVE-2026-39821 →CVE-2026-42502 →CVE-2026-63209 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader CVE-2026-104795 — insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution CVE-2026-107176 — cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:9a992a1d21b1c08e489d846f9a04a4163ad1d49f4076f37e1eb7329ccf4d17c3_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:9c29f5a144d360eb22e7107d3c83ad2f13a4d87e8a056851c6b5b80d8bed8cb3_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:c386a2b9e19f2c440f25c685f97cb3b61d508be61580eb1c7d2e37506b7911ae_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:fd5daa55ab6ecd93e0a10eb115369201b1cca98c6f832479f2ee849687a514cd_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:4b4048bc11b389cd221f56ffef74719ae1c307724751702d0403d7cb20e5ab29_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:81414b465083b2b78af4591f9be96d44bf888fbe2bca2dce11a8df6eff90b6d8_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:9108e590e6515bd26daf71848867686e8af35f9e63e3c3bf5ea713db4d0931e1_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:b39fa65bbae3553aa1d2ee5dfe431b49d1a116df842f7a90efa5402b4929b9aa_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:6bf8bef996886249088fa96d2bded39b66b8109b1f24a5b4a51a8100a8c6374f_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:88d403a4adaa8854f3c2cfa156f776cacf6cba73dbda0cd4358f4939fc62e79e_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:a2a45ec6a92fa0103307aa89375577f5eef2c6abd2577982a2ba54acb74bd7dd_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/aws-node-termination-handler-rhel9@sha256:f64dff59322b30e9f88affd2e2aecb3119d87350d20f35e1197003a33d89a626_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:266f15c5dbc825589fa537b79957bd81ae7b32db77210729891c68fa81a236c6_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4184fbf51a46c223b9cccf0b94f03b8bc00b8846679758f7223327d844bcaccc_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:41a7578020f9f5212b736cd3bdccfa37cdb6ba1ee2dc2ae830e1b758dbce6bef_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:4b850af6d0284dea7bbcdbf8bd4957aa560ff4dae196123b3698c0aa65e20bf0_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:3ca65aa6c18f3d31c487f35a31ae2a8357cf4d78f2995385bd8eb5f4d2283777_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:63578059530084b8247e57106b3b889ef2a1306c302671d8323c75a7502e70ea_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:6dde9fe2cafa06e00802fc0de53cfe3dc374f748a2ccaab317a106ac1223e7b4_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:a3f7dac123da69f1d2564267cffd3baefea217443116b384f6a55dac5bcbb55d_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:01df1a4b9de7b602bb36e825fe079b88f1025558e217af1e76a6f3ed9a871e13_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:4b7a12d25e3d93790c06d3d97997a37b39a3f4c033e2e559f513442a163a6f31_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:5f1f93bcabd9f6f69220806b65a14c2ec8f91fc2e634f38941bc395eb67532ba_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:abaff3b34538bf813be4bfcdab49eeef34145409cfd4a643dfcb706f5bc052e8_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:ae8469fe3dd97d37543f9ff754f5909d7b9706516047b609d4a4cad169e53827_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:b5045831423dfdc45d2663a115f53ccf07f56956093e775c2d3b2b73355a3c41_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:c2dda72170cac501fe4545b60c29edafc538bde3b105aacbd79af18720dc47b2_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:df0abce836307b406534c03cbcdc8e8f32ff86f082d99b721b8bc2f7c22694d4_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:3d2000e6f95639652b9a58cabdf8c4e5cd31af220ff1859de5238b4aa13953e4_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813 (For s390x architecture) The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e (For ppc64le architecture) The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2 (For aarch64 architecture) The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866 All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: The vulnerability requires a code fix to implement a complete privilege drop (setting all three UID/GID fields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`) before executing any fingerprint binary. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (11)