CVE-2026-35469 is a denial of service vulnerability in the SPDY streaming code utilized by Kubelet, CRI-O, and kube-apiserver within Red Hat OpenShift Virtualization. Exploitation requires an attacker to have specific elevated cluster roles, such as permissions for pod port forwarding, execution, attachment, or node proxying. Successful exploitation can cause these critical components to become unresponsive, impacting availability. The vulnerability is tracked under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has released OpenShift Virtualization v4.19 images containing fixes for this issue. Mitigation includes restricting assignment of the relevant Kubernetes cluster roles to trusted users only.

The vulnerability can cause denial of service by making Kubelet, CRI-O, and kube-apiserver components unresponsive, impacting the availability of OpenShift Container Platform environments using affected versions. No confidentiality or integrity impacts are reported. Exploitation requires low privileges but specific elevated cluster roles. There are no known exploits in the wild at this time.

Red Hat has released OpenShift Virtualization v4.19 images that fix this vulnerability. Users should update to version 4.19 or later. Additionally, review and restrict Kubernetes cluster roles that allow pod port forwarding (create), pod execution (create), pod attachment (create), and node proxying (get/create) to trusted and authorized users only. Modifying RBAC policies should be tested carefully to avoid disrupting legitimate application functionality. No other fixes or mitigations are indicated by the vendor advisory.