RHSA-2026:17474 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 4.21.16 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.21.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.21.16. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:17472

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

Solution

For OpenShift Container Platform 4.21 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:5883651d854e5056a10052cc1b4cf319387b7d96f9fa668e385a49659177264b

(For s390x architecture)
The image digest is sha256:94c8e01e933758496eb9aed0be3b0aa9b24b112c24f453553e447a43397155d2

(For ppc64le architecture)
The image digest is sha256:fb86c09b7f3e249c79b5b8d753a8cd8f419b7dec84c073eab63ebd12a4708798

(For aarch64 architecture)
The image digest is sha256:e6ba7c4476044cfd185679675907b8b4c247189a5fb9204bccd3d27c2f05ffcc

All OpenShift Container Platform 4.21 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

• Red Hat OpenShift Container Platform

Fixes

• BZ - 2407258
• BZ - 2428412
• BZ - 2449833
• BZ - 2453284
• BZ - 2455470
• BZ - 2457432
• BZ - 2457729
• BZ - 2461606
• BZ - 2461607
• BZ - 2461626
• BZ - 2461629
• BZ - 2461630
• OCPBUGS-74420 - OVE UI: Failed to create infrastructure environement
• OCPBUGS-77473 - 4.21 PTP CI T-BC suddenly announces 'offset 99999999999 T-BC-STATUS s0' while in Holdover-out-of-spec
• OCPBUGS-80924 - [4.21] GNR-D T-GM: leapfile configmap is not updating
• OCPBUGS-82163 - Migration from Yarn Classic (v1) to NPM
• OCPBUGS-82298 - [release-4.21] BMH fails inspecting on SuperMicro ARM GH due to incorrect boot order
• OCPBUGS-82543 - [v2] oc-mirror should only show the images that are being collected during collection phase.
• OCPBUGS-82546 - Log output shows rebuilding of catalogs for full: true with zero packages
• OCPBUGS-83494 - [release-4.21] Developer View Observability Tabs Disappear After OCP 4.20.12 Upgrade
• OCPBUGS-83608 - Bump Kubernetes v1.34.7 to release-4.21
• OCPBUGS-83849 - [Appliance] [OVE - SaaS UI] Installation fails due to missing release payload signature using stable releases
• OCPBUGS-83852 - Pass through environment variables to appliance for Agent OVE ISO
• OCPBUGS-84225 - [IBMCloud] IBM Cloud VPC Go SDK cannot unmarshall security group rules with protocol: "any"
• OCPBUGS-84253 - Using credHelpers in global pull-secret throws errors during cluster upgrade to OCP 4.20
• OCPBUGS-84623 - The Openstack platform should create a TCP Amphora LoadBalancer when LoadBalancerService ingressController is created on Openshift
• OCPBUGS-84858 - [release-4.21] ConsoleDataView Name and Label filters appear after additional filters in toolbar
• OCPBUGS-84878 - [Automated] Update AMI Whitelist
• OCPBUGS-84892 - [Appliance] OVE: release-4.21 branch has MaxOcpVersion="4.19" instead of "4.21" causing fallback to wrong minor version
• OCPBUGS-84896 - [release-4.21] - [Appliance] [OVE - SaaS UI] Installation fails due to invalid InternalReleaseImage name
• OCPBUGS-84922 - [4.21] crio process crashed with "panic: send on closed channel" after attempting to stop a container
• OCPBUGS-84941 - MCD rollback doesn't properly handle passwords and sshkeys
• OCPBUGS-84947 - Pods intermittently cannot start (image pull fails to complete from quay)
• OCPBUGS-84956 - [release-4.21][Below the sea UI] Remove 2 node arbiter option from the control plane dropdown option
• OCPBUGS-84967 - [release-4.21] ConsoleDataView should have both top and bottom pagination controls
• OCPBUGS-84970 - New node provisioning fails during upgrade rollout and it has been failing at firstboot.
• OCPBUGS-84978 - Test failure in upgrade jobs- [bz-Image Registry] clusteroperator/image-registry should not change condition/Available
• OCPBUGS-85016 - [4.21] e2e: Add irqbalance StartLimitBurst >= 100 config test
• OCPBUGS-85261 - [release-4.21][Below the sea UI] Leaky Abstraction: Transient 500 errors exposed during host binding process
• OCPBUGS-85365 - 4.21 CLONE - CPU spikes after enabling ANP

CVEs

• CVE-2026-22029
• CVE-2026-33186
• CVE-2026-34043
• CVE-2026-34986
• CVE-2026-40175
• CVE-2026-42033
• CVE-2026-42035
• CVE-2026-42039
• CVE-2026-42041
• CVE-2026-42043

References

• https://access.redhat.com/security/updates/classification/