Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.19.49. There is no advisory for the RPM packages for this
release.

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Security Fix(es):

* acl: Symlink traversal privilege escalation via libacl functions
(CVE-2026-54369)
* openssh: OpenSSH: Use-after-free vulnerability during host key
re-exchange on the client side (CVE-2026-60002)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.19.49 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.21.35. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2026:71443

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

Security Fix(es):

* acl: Symlink traversal privilege escalation via libacl functions
(CVE-2026-54369)
* openssh: OpenSSH: Use-after-free vulnerability during host key
re-exchange on the client side (CVE-2026-60002)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.21 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.21.35 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.20.40. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHBA-2026:71441

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Security Fix(es):

* acl: Symlink traversal privilege escalation via libacl functions
(CVE-2026-54369)
* openssh: OpenSSH: Use-after-free vulnerability during host key
re-exchange on the client side (CVE-2026-60002)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.20 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.20.40 bug fix and security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: acl security update

Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.

Security Fix(es):

* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)

* acl: TOCTOU Symlink Traversal via getfacl/setfacl (CVE-2026-54370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update includes the following RPMs:

acl:
  * acl-2.4.0-0.1.hum1 (aarch64, x86_64)
  * libacl-2.4.0-0.1.hum1 (aarch64, x86_64)
  * libacl-devel-2.4.0-0.1.hum1 (aarch64, x86_64)
  * acl-2.4.0-0.1.hum1.src (src)

Security Fix(es):

acl:
  * CVE-2026-54369
  * CVE-2026-54370

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.

Search: CVE-2026-54369