A flaw was found in the OpenShift Router. (CVE-2026-42965)

CVE-2026-42965 is a security flaw in the OpenShift Router where a user with EndpointSlice write permissions can exploit the vulnerability by creating a Service backed by an FQDN EndpointSlice that resolves to a cloud metadata endpoint. This causes the router to proxy requests to the cloud metadata endpoint, leading to disclosure of instance credentials and other sensitive metadata. This vulnerability bypasses previous security measures that validated IP addresses. The vulnerability affects OpenShift Container Platform versions >=4.20.0 <4.20.34 and >=4.21.0 <4.21.29. Red Hat has released OpenShift Container Platform 4.20.34 with fixes for this issue and advises users to upgrade to this version or later.

An attacker with EndpointSlice write access can cause the OpenShift Router to proxy requests to cloud metadata endpoints, resulting in the disclosure of instance credentials and sensitive metadata. This can lead to unauthorized access to cloud resources and potential compromise of the affected environment. The vulnerability bypasses existing IP address validation security controls, increasing the risk of exploitation.

Red Hat has released OpenShift Container Platform 4.20.34 which includes a security update addressing this vulnerability. Users of affected versions (>=4.20.0 <4.20.34 and >=4.21.0 <4.21.29) should upgrade to version 4.20.34 or later to remediate this issue. Follow the official Red Hat upgrade documentation to fully apply the update. No additional mitigation steps are indicated beyond applying the official fix.