RHSA-2026:89341HighCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.20.44 bug fix and security update

Published
October 26, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (7)

CVE-2026-33814 →CVE-2026-34986 →CVE-2026-39821 →CVE-2026-46597 →CVE-2026-104795 →CVE-2026-107176 →CVE-2026-111943 →

📋 Description

CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-104795 — insights-runtime-extractor: insights-runtime-extractor: Container Escape via Privileged Binary Execution CVE-2026-107176 — cluster-samples-operator: Role reads ALL secrets in openshift-config, not just pull-secret CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products200

  • Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:2d6f31c8ef825ee635096afd9c25b6f0f7d9febc6e5403f47b3437302901a934_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:3392f22f3a61dc88e3e75f4621f92b5911ff741feb2ddcca6aa299f24006d995_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:6b069f4493f9d8d61e055fa5596c1186d2026fde76c63eac943430f9bd9e667f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9@sha256:fbd077a35ff1aba9aaa3af01c162845612d0f311cd2063b39fd86338bd5e21e5_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:55619dd5db989644d9a9a355ff8c8d07a385d56586945e7de673e27617fec078_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:7d5bb31b1fa9c8519f7dddfac2941fa464e14e8f8226243a05ecc380d5945e61_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:c7f4c3eec1decf98f91781fe88ba81aed3bd443b8458d8f1b1574d1fea17e7d7_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9@sha256:e80115b6d54a67baba57aa1883b68c7f2511911823e65752410a995b5a2ba490_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:575a29989602007b87be7caa17a2402f563d91cec27b578c7619c3dea1a0a8ea_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:b403fbf8406213b1ff67e3e32027b983a77d4a30dc130be1d2e0cc794ce656b4_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:c09ef183d3ce3607034583919878017cc35a69df2c1e490b61d8a68e7ad546dc_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9@sha256:e7c1b11bbbf0a33da9fa7e427b38a2b896059ff7aae25467af53119a17a07965_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:57e2fc42833b7e7b85374b589dcfa278e7a330f54a7dab65d1fdf007edf406d3_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:8e432673bfaa2cb9ce4d7c35839b67084871b0096414ac6bd292023ea4e8b61f_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:adf118179d9b336910b150d0470bad15b79c8aeb9ed253ab21fc8f940cc0e515_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:e3142ee1f203c428cee03987e30d30b9f94398412119d0d8f295269ab76de8f1_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:73ea871c608b3000031e2848e627fde50c53606ad006d43a0b520557cacdf13f_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:aa4aafe17abb4a1eac8eee5a55ba98f6ec52fb70e6ff80610ea12cecdc1977d9_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e2b17282e3a9d18d21b3b251c0b9f6852877209126d1d2e72502389d233d38d8_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel9@sha256:e776c594b086193dac0787def811a3af7cec40cb2d1a4316aed0679b7423b2a6_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:47a9f403f0e707cfe48b7e6612d4d135a682bf4ec64f539e5d671e098b6484d0_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:565c4fb1da80dd9cf050dbb6c0b2a6a3d6fdef95f5d40cb0147ef39bd139f9fa_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:8226bc9ebca67110786c2bfa48385e2f91482c82f5d42570caccb66e1c6a8647_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/container-networking-plugins-microshift-rhel9@sha256:ddf49f27d1c0d2cfdff6e1bbd59eb9d5f8dfa3fea8831c6617229ec6dec3daf7_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:19452612dc023f20f87645731de959b8b1cd5585c4acec0de2500eacd7414104_arm64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:75dd5e9339fe95c1958f6d22e37fbf63f4be1b1c5910615380ca08a71fd57819_s390x as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:a78f9b622d91a11dbe2cc10dacccafe31fef9118932ea7abcf5bfe1af630fb24_ppc64le as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:ab665433f2e3a134303204ef51d0e05b85c6aa2b89af39c36252b34ea0c1600e_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • registry.redhat.io/openshift4/egress-router-cni-rhel9@sha256:2883f807b61df77e13abdbfa9849aa88095bf867ee0bf40a8a3e87132cac5f62_amd64 as a component of Red Hat OpenShift Container Platform 4.20
  • +170 more not shown

✅ Remediation

For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:437514ee0f768d8116c19f527be1eaa239ce26ccef6abbf0cb7ebf0056ec6e15 (For s390x architecture) The image digest is sha256:58cdbc266aef95d5d972872cf49932e345b1c44165310f3a7cc237cea7437dca (For ppc64le architecture) The image digest is sha256:373a67d9fb8e142c5e0b8600d49a1b80306e9a934dbefa8c584476c7aa8ef5d5 (For aarch64 architecture) The image digest is sha256:383135875bd9c114e64aba80fc3563716da12f36e5448107060d8b47a6f7e8bd All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: The vulnerability requires a code fix to implement a complete privilege drop (setting all three UID/GID fields, clearing all Linux capability sets, and setting `PR_SET_NO_NEW_PRIVS`) before executing any fingerprint binary. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (10)