RHSA-2026:90274HighCVSS 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.102 bug fix and security update

Published
October 27, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (12)

CVE-2026-111943 →CVE-2026-33186 →CVE-2026-33814 →CVE-2026-39829 →CVE-2026-39830 →CVE-2026-75888 →CVE-2026-83589 →CVE-2026-93017 →CVE-2026-39831 →CVE-2026-39832 →CVE-2026-46597 →CVE-2026-55204 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-55204 — haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-75888 — openshift/console: openshift/console: Authenticated SSRF via Helm chart URL fetch CVE-2026-83589 — oauth-proxy: Open Redirect via /\ and /\t Bypass in Post-Login Redirect CVE-2026-93017 — insights-operator: gather ServiceAccount has cluster-wide Secret read plus nodes/proxy and cluster-reader CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products191

  • Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/cloud-network-config-controller-rhel8@sha256:6b9cb446c336c29831c1600b4790a4e1124e753626255d0d75a1a6853972dc48_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/driver-toolkit-rhel8@sha256:5709e2e2da28b6caf11060fc9697a5293f5040e29c2ce02ad92121ab71cc17c2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/egress-router-cni-rhel8@sha256:7888205ac96bcf8a6d0a8a114a99ecd6e41819f8f724721d30752dfdf8e602a5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8@sha256:32deff6c04e8c2b623055f6e8c6cfe82b7375bd595fb5d82edd8f6cf56e452a0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/network-tools-rhel8@sha256:2c53fde5060a21d117e64b18dc0182deed4d7263c7773bc91f0a141087a28b34_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/oc-mirror-plugin-rhel8@sha256:87df11ba6d2a2514ba6c5d4c98291ae1c0122bec9e4278b955444443d2e6e247_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/openshift-route-controller-manager-rhel8@sha256:1cd0612b71bc0b3deb4da4f9c3d0dc08ada90ced7f989b903a9d10392fa7b681_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:212290ba5c8cb2a4f61fa2eacecedde3a13b356850b762c33a05e92d0de14a47_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel8@sha256:f818b3e85e4c468828e896b470e9626ff89894bca41e1e007ae0c0d7ed41db3f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel8@sha256:389db939402f2ffa566400ff77c1a4b442cb3388436169f467197cde0461615d_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-agent-installer-orchestrator-rhel8@sha256:658fd90f001ff9e7ec88ca7cfe2e695f83fc8f144c0c4fb1c5d02a69bf2253ff_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:e1ba6f80b0109b899b6828e30175306650d42b368eebdaeafc7fcb8adcc05af0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-cloud-csi-driver-container-rhel8@sha256:8930998ef218b94b30f864a3a1f1762991ec967c52c778bdfebafa08498a5dd0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8@sha256:a48adf5104cf40e902e1863b85db8ee62edbd1b55e7acddb7755a461d260399e_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-alibaba-machine-controllers-rhel8@sha256:08f416e1c373635a68d061f788959d4cf8f2d55d71e5c08e4e82b956900ab73f_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel8@sha256:3c9a2a2af5311e2e05aa6037cb9a4e06484433e96c92204b1d6d62ad6dabd59b_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cloud-controller-manager-rhel8@sha256:748b69d083dec0a08472eb801aae167e14a138807519a3799f8773aec9183e44_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:e013146d52855df614b5dfdc67c990a0bad40d881622e0fe86a23db244bad2d9_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8-operator@sha256:fabe85718b06e9a17124e349ed703e2e7be9144b9cdb918f5537e63e3fbb93dc_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:2d59c7cee076dc7d86301253b0abbb87bc3714928efdf8f24e69139f3bf47342_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-aws-pod-identity-webhook-rhel8@sha256:d1556a726fd45c33144000dbb112bb385849267ed5b91dbea96f31339ea23e17_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8@sha256:6a8aa724be3817a641af8a319a51e3de6694b6e4d83ae9c20ce77457f0fdd365_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8@sha256:73696795ee87c3a1c184ac9d153e76c071a78e5fc5a7cca08ac882e6f26fa2ff_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel8@sha256:b699245b83103b45e1e0afa0d9168ded91ec88d610b93bfffad4f31a94dc6ef2_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8-operator@sha256:e1a247272a42c003ab970862d191e805f63ee566968c8d2e0e723a669cdf81a0_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-disk-csi-driver-rhel8@sha256:4b6c6f0d94a7a638a9d36fbedc68e2f845de4bb8599432c74a623df72c5fdae5_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel8@sha256:728e97ea895bb38eb1ca3e2149fcfae7f655b5d117ead05817a3eb76495436da_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8@sha256:90bf5a473885cea836fe912af0ed5c4d6b94cd694f95577b5a5769329276b713_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • registry.redhat.io/openshift4/ose-baremetal-installer-rhel8@sha256:9db882720cb848c3090e78e1a19c98ab82f3e6b7facef4f4a656c67165a9eaca_amd64 as a component of Red Hat OpenShift Container Platform 4.12
  • +161 more not shown

✅ Remediation

For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Red Hat has not identified any known mitigations for this issue. Customers are advised to apply the available security update when released. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (15)