RHSA-2026:89199HighCVSS 7.7

Red Hat Security Advisory: OpenShift Container Platform 4.22.20 security and extras update

Published
October 26, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (3)

CVE-2026-33814 →CVE-2026-85781 →CVE-2026-102278 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-85781 — github.com/kubernetes-sigs/aws-efs-csi-driver: Amazon EFS CSI Driver: Unauthorized directory deletion via unverified access point ownership CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns

🎯 Affected products171

  • Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:07ec7a3dc4a7e52ca1d3b6ac4f1c2aee604393dd11130b5c5810c81215af0374_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:9b4feb70b89df3dc283d602f8925d2c1c5e8c3ffec9ce0a575c15a1df01bf838_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:a10c289662404b7cd9192e15b69fe37328ca1584292ccbfea6728cfcaa4487db_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9-operator@sha256:a395faf6eeb56e36c8ef429326ef0a37d4332b470fad3dacde56b9d0522326ae_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:10909f413529aaa1eb953df3b8e62832856d4fff8c7567b46f19ffe3a4c10c45_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:34e57b37331fb72a05f400fe8e3e23c4930b7bc6567f5c6d8d60791ecd779a09_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:5cf58b4a670cc8afdedcabb6004b47abfeb46ecd86253c28046798e2b20bc78a_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ingress-node-firewall-rhel9@sha256:b4067714b682a12a846a47b91e27376c739415c7e55a352bf6279d943383cfad_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:3be204301baa11ebfaefab7f4aa0f5ca451abaa048e9facd9b6be1b3d8c3bcda_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:485ce5e7ddef99f283a2a9d5865cef1cff3e0f67361f2d6f44e01dca2015211c_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:7477fff9176a9b133c764f055cf67a0ea96179b49e7c3e43986d131ad34f79d2_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kube-compare-artifacts-rhel9@sha256:bc4bdab87a4dd75795f554b1d4a87a848bdffff0773df74cb65652604a6efe01_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:09c481081511ba68d06e1bb47b7a0931dd0b01f0909e4149b5c80973191b7351_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:657645dd7280f007325b354be39d67097b29f02d94ca31fa9b75a112355f73d1_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:e2b7b2246061adfa0de4acddfd604c104c9cd9d636045cfcac4682af121ebb07_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/kubernetes-nmstate-rhel9-operator@sha256:f9d64d69b42d11510f0abadc821da36f3168c38e46ab7ce6bcf94120666617c7_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:5a636aee95a90925618b1bce8b68d7f4078a162251dd1161c8aa8c5743e5373a_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:91ee28e192b421496dc638ad1b18ebe8a2732ea767217b06a211d71e880b9ba9_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:94e7d0ebacbaa41c13aaeafe7200b9c6f61b5685eeb125a2a572baa22da15890_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9-operator@sha256:d8f9f1a8a91d01c76088b414282607215ea7df09b80fc8c583c18ca290fc0677_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:04fb5dd0779641c29f3dfd9c892fb77e9cb36501eed654cdb2e95df8d044df37_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:0628c1bcde9292d914204cbb716fed6d43cbdc2f33d47e2c22c8a808e21a678b_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:7a2b726b745c8f23aaff8e6760c65912598a9666320e5dfb45f24415780fc2a8_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/metallb-rhel9@sha256:7d2c7ec61d13f0dc774610a8a59a1a5c66439d6b8c5171aca9b7ebbab97b1374_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:1f9470a752d593338e1e02efbf0eb16a81a5772441951404242eef8d8eedf4d9_s390x as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:280e10722c3d76b6e6681095dbd40215eb676004547a127a629d4be0bc7bf8d4_amd64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:d690c3cbf232ad533bff86e4247c448cb5bf5767b1f8ac849b751fbb468a9c38_ppc64le as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/nmstate-console-plugin-rhel9@sha256:ff981e4be57c9491ed08b3881232c99ae9b3a51cef7308a240280664b67cfd04_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • registry.redhat.io/openshift4/ose-ansible-rhel9-operator@sha256:4968209fdd9ae0148cb75e542ee500950a7ba7f6beee8992f95b412f752e4acc_arm64 as a component of Red Hat OpenShift Container Platform 4.22
  • +141 more not shown

✅ Remediation

See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Details on how to access this content are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Ensure the EFS CSI Driver controller is configured with --delete-access-point-root-dir=false (the default setting). Deployments that have not explicitly enabled this flag are not affected by this vulnerability. If the flag is enabled and required for your workflow, restrict PersistentVolume creation privileges to trusted administrators using Kubernetes RBAC.

🔗 References (6)