CVE-2026-35469 is a denial of service vulnerability affecting the SPDY streaming code in Kubelet, CRI-O, and kube-apiserver components of Red Hat OpenShift Container Platform. The flaw allows an attacker possessing specific elevated cluster roles—such as permissions for pod port forwarding, exec, attach, or node proxying—to exploit the vulnerability and cause these critical components to become unresponsive. This impacts resource availability and can disrupt cluster operations. Red Hat has issued a security advisory with updated RPM packages and container images in OpenShift Container Platform 4.18.42 to fix this issue. The advisory also recommends reviewing and restricting cluster role assignments to mitigate risk. The CVSS v4.0 base score is 8.7 (high severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and high availability impact.

Exploitation of this vulnerability can cause denial of service by making Kubelet, CRI-O, and kube-apiserver unresponsive. This affects the availability of critical Kubernetes components in OpenShift Container Platform clusters. The attacker must have specific elevated cluster roles related to pod port forwarding, execution, attachment, or node proxying. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported at this time.

Red Hat has released OpenShift Container Platform 4.18.42 containing fixes for this vulnerability. Users should upgrade to this version or later using the OpenShift CLI or web console following Red Hat's documented upgrade procedures. Additionally, it is recommended to review and restrict the assignment of Kubernetes cluster roles 'pods/portforward (create)', 'pods/exec (create)', 'pods/attach (create)', and 'nodes/proxy (get/create)' to only trusted and necessary users or service accounts. Careful testing is advised when modifying RBAC policies to avoid disrupting legitimate functionality. No other mitigations or workarounds are specified.