The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.

Red Hat Security Advisory: Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.20.23. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:17466

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.20.23 bug fix and security update

A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: gvisor-tap-vsock security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: skopeo security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.88. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:12273

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

Red Hat Security Advisory: OpenShift Container Platform 4.12.88 bug fix and security update

VolSync v0.14 is a Kubernetes operator that enables asynchronous
replication of persistent volumes within a cluster, or across clusters. After
deploying the VolSync operator, it can create and maintain copies of your
persistent data.

For more information about VolSync, see:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/business_continuity/business-cont-overview#volsync

or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.

Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.20.19. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHBA-2026:8430

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.20 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.20.19 security and extras update

Kiali 1.73.29, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently.

Security Fix(es):

* CVE-2025-61726 Memory exhaustion in query parameter parsing in net/url (OSSM-12470)
* CVE-2025-62718 Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (OSSM-13225, OSSM-13226)
* CVE-2025-68121 Unexpected session resumption in crypto/tls (OSSM-12553)
* CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url (OSSM-12952)
* CVE-2026-27606 Rollup: Remote Code Execution via Path Traversal Vulnerability (OSSM-12689)
* CVE-2026-29074 SVGO: Denial of Service via XML entity expansion (OSSM-12891)
* CVE-2026-29063 Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (OSSM-12970, OSSM-12971)
* CVE-2026-33186 gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (OSSM-12996)
* CVE-2026-4800 lodash: Arbitrary code execution via untrusted input in template imports (OSSM-13112, OSSM-13113)
* CVE-2026-40175 Axios: Remote Code Execution via Prototype Pollution escalation (OSSM-13249, OSSM-13250)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.37. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:6552

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.18.37 bug fix and security update

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

Red Hat Security Advisory: Multicluster Global Hub 1.4.5 security update

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

Security Fix(es):

* yggdrasil-worker-forwarder: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* yggdrasil-worker-forwarder: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)
* yggdrasil-worker-forwarder: Unexpected session resumption in crypto/tls (CVE-2025-68121)
* rubygem-rubyipmi: Remote Code Execution in rubyipmi via malicious BMC username (CVE-2026-0980)
* rubygem-foreman_kubevirt: foreman_kubevirt: Man-in-the-Middle due to insecure default SSL verification (CVE-2026-1531)
* foreman: Foreman: Remote Code Execution via command injection in WebSocket proxy (CVE-2026-1961)
* rubygem-katello: Katello: Denial of Service and potential information disclosure via SQL injection (CVE-2026-4324)

Red Hat Security Advisory: Satellite 6.18.4 Async Update

Red Hat OpenShift Service Mesh 3.2.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Fixes/Improvements:

* Updated to Istio version 1.27.8

* Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585)

Security Fix(es):

* istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)

* istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.2.3

Red Hat OpenShift Service Mesh 3.1.6, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.
    
Fixes/Improvements:

* Multiple InferencePools on same Gateway - ext_proc lost for all but first (OSSM-12585)

Security Fix(es):

* istio-rhel9-operator: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-cni-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-pilot-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-proxyv2-rhel9: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* istio-rhel9-operator: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-cni-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-pilot-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-proxyv2-rhel9: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* istio-rhel9-operator: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-cni-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-pilot-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-proxyv2-rhel9: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* istio-rhel9-operator: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-cni-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-pilot-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-proxyv2-rhel9: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* istio-rhel9-operator: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-cni-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-pilot-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-proxyv2-rhel9: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* istio-pilot-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)

* istio-proxyv2-rhel9: JWKS Resolver Failure May Expose Hardcoded Default Keys (CVE-2026-31837)

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.1.6

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: osbuild-composer security update

Red Hat Security Advisory: Red Hat Quay 3.9.19

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: delve security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: image-builder security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Search: CVE-2025-61726