CVE-2026-35172 is a vulnerability in the Distribution toolkit used for managing container content within Red Hat OpenShift Container Platform. When specific caching and deletion features are enabled, the system fails to fully remove all references to deleted content, allowing a remote attacker to read previously deleted data. This results in an information disclosure vulnerability categorized under CWE-524 (Use of Cache Containing Sensitive Information). The issue affects OpenShift Container Platform versions >=4.12.0 and <4.12.92. Red Hat has released version 4.12.92 containing updated container images and RPM packages that fix this vulnerability. The Red Hat advisory rates the security impact as low, but the CVSS v3.1 base score assigned by Red Hat is 7.5 (high). No known exploits are reported in the wild. Users should upgrade their clusters following Red Hat's documented procedures.

The vulnerability allows unauthorized disclosure of sensitive information by making previously deleted container content readable again due to stale references in the cache. This could expose confidential data to remote attackers without requiring authentication or user interaction. The impact is limited to confidentiality; integrity and availability are not affected. Red Hat rates the security impact as low, but the CVSS score indicates a high confidentiality impact. There are no known active exploits in the wild.

Red Hat has released OpenShift Container Platform version 4.12.92 which includes updated container images and packages that fix this vulnerability. Users should upgrade to version 4.12.92 using the official OpenShift upgrade procedures documented by Red Hat. No additional mitigations are specified or required beyond applying the official update. Users can verify image digests and use the OpenShift CLI or web console to check for updates.