RHSA-2026:94538 - Security Advisory

Topic

Red Hat OpenShift Container Platform release 5.0.1 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 5.0.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 5.0.1. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:94536

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/

Solution

For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a

(For s390x architecture)
The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef

(For ppc64le architecture)
The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52

(For aarch64 architecture)
The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621

All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

• Red Hat OpenShift Container Platform

Fixes

• BZ - 2535609
• OCPBUGS-112580 - fwupd-refresh.timer causes latency spikes on RHEL 10
• OCPBUGS-115064 - [Release 5.0] Install NOO using OLMv0 instead of OLMv1
• OCPBUGS-115479 - [oadp-1.6] Hypershift Velero Plugin errors on MC-wide backups causing PartiallyFailed status and duration regression
• OCPBUGS-120739 - [OVE] OLM operators installation fails when LVMS operator has been selected
• OCPBUGS-126900 - Registryless installs should be distinguishable from regular ABI in Telemetry
• OCPBUGS-127425 - restore script to handle files other than /var/lib/etcd/member in /var/lib/etcd/ dir
• OCPBUGS-128820 - Appliance generates mismatched release bundle names for stable releases
• OCPBUGS-128866 - [5.0] 4.22+ should not show limited support warning
• OCPBUGS-131014 - MCD fails to rollback from OCL to stock RHCOS when extensions are installed
• OCPBUGS-132356 - PTP Daemon attempts to conncet to Cloud Event Proxy even if it's disabled by the PTP Operator
• OCPBUGS-132682 - [release-5.0] Secret reader clusterRole is not created
• OCPBUGS-133261 - HCP OCP5 Y-stream stuck on Upgradeable=False (ResourceDeletesInProgress) — staging
• OCPBUGS-133334 - Unstable test: 66436 disable weak SSH cipher suites
• OCPBUGS-133420 - [5.0]Extend PHC stepping plugin to work with hardwareconfig
• OCPBUGS-133480 - [Below the sea UI] Remove unsupported networking fields
• OCPBUGS-133720 - [release-5.0] After clicking "Reveal Values" for secret data the values will automatically hide
• OCPBUGS-134591 - [5.0](HPE GNR-D)Failed to resolve DPLL pin commands for condition Initialize T-BC
• OCPBUGS-134739 - [MCN] status.configVersion.current left stale
• OCPBUGS-135079 - [release-5.0] Default Console image CSP omits blob sources used by custom branding
• OCPBUGS-135090 - [release-5.0] Remove redundant detailsPage wrapper to prevent details tab state resets
• OCPBUGS-135091 - openshift-cluster-machine-approver namespace has no NetworkPolicy
• OCPBUGS-135361 - [release-5.0] Create service form shows stale data
• OCPBUGS-43501 - coreos-installer iso kargs show broken when using minimal ISO
• OCPBUGS-82292 - InternalReleaseImage MachineConfigNode status image field does not accept localhost
• OCPBUGS-82502 - driver-toolkit payload job broken for OCP 5
• OCPBUGS-85294 - [operator-conditions] test regressed due to permafailures of vsphere hybrid-env job
• OCPBUGS-86294 - Compute - MachineSets - Details: Create MachineAutoscaler loading blank page instead of pop-up
• OCPBUGS-86472 - UPI multi-vcenter job permafailing install
• OCPBUGS-98449 - Console: Global Redux timestamp dispatch causes unnecessary re-renders across all UI store subscribers every 10s
• OCPBUGS-99757 - oc-oidc exec plugin ignores --extra-scopes when returning cached tokens

CVEs

• CVE-2026-82399

References

• https://access.redhat.com/security/updates/classification/