This advisory covers Red Hat OpenShift Container Platform 4.18.42, which contains fixes for several bugs and security vulnerabilities. Notably, CVE-2026-33186 is an authorization bypass vulnerability in the gRPC-Go implementation due to improper validation of the HTTP/2 :path pseudo-header. Attackers can exploit this by sending malformed :path headers lacking the mandatory leading slash, potentially bypassing authorization controls and accessing unauthorized services or information. The update includes container image updates and RPM package fixes. Red Hat rates the security impact of this update as Important (high severity).

The primary impact is an authorization bypass in gRPC-Go that could allow remote attackers to circumvent security policies and gain unauthorized access to services or sensitive information. This affects deployments of OpenShift Container Platform that use the vulnerable gRPC-Go component. The vulnerability has a CVSS v3 base score of 9.1 (Red Hat rating), indicating high severity with high confidentiality and integrity impact but no availability impact. No known exploits in the wild have been reported at this time.

Red Hat has released OpenShift Container Platform 4.18.42 containing fixes for this vulnerability and other issues. Users should upgrade to version 4.18.42 using the official upgrade instructions provided by Red Hat. Additionally, to mitigate CVE-2026-33186, infrastructure-level normalization of HTTP/2 :path headers is recommended, such as configuring reverse proxies or API gateways to validate and normalize the :path header before it reaches the gRPC-Go server. This update is available via the appropriate release channels and can be applied using the OpenShift CLI or web console.