CVE-2026-42965 is a security flaw in the OpenShift Router component where a user with EndpointSlice write permissions can exploit the vulnerability by creating a Service backed by an FQDN EndpointSlice that resolves to a cloud metadata endpoint. This causes the router to proxy requests to the cloud metadata endpoint, leading to unauthorized disclosure of instance credentials and other sensitive metadata. This vulnerability bypasses prior security controls that validated IP addresses, thus enabling access to sensitive cloud metadata. Red Hat has issued security advisories RHSA-2026:54583 and RHSA-2026:54602, releasing updated container images and packages for OpenShift Container Platform versions 4.20.34 and 4.21.29 respectively, which fix this issue. Users should follow Red Hat's upgrade instructions to fully apply these asynchronous errata updates.

Exploitation of this vulnerability allows an attacker with EndpointSlice write access to cause the OpenShift Router to proxy requests to cloud metadata endpoints. This can lead to the disclosure of instance credentials and other sensitive metadata, potentially compromising cloud infrastructure security. The CVSS 3.1 base score is 7.7, indicating a high severity impact with network attack vector, low attack complexity, and no user interaction required. The confidentiality impact is high, while integrity and availability impacts are none.

Red Hat has released official security updates fixing this vulnerability in OpenShift Container Platform versions 4.20.34 and 4.21.29. Users should upgrade their clusters to these versions following the vendor's documented upgrade procedures to fully mitigate the issue. No additional mitigation steps are indicated beyond applying the official patches. Patch status is confirmed by Red Hat advisories RHSA-2026:54583 and RHSA-2026:54602.