Red Hat OpenShift Container Platform 4.22 vulnerabilities

Product

Red Hat OpenShift Container Platform 4.22

by Red Hat · last CVE Oct 12, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities63 In the news0 Timeline

Severity mix

Critical 10High 46Medium 7Low 0

Severity

All severities63 Critical10 High46 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Red Hat OpenShift Container Platform 4.22 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-75886	7.2	0%	Sep 23	Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding Affected: All versions, or not specified
CVE-2026-96577	7.1	0%	Oct 1	Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled Affected: All versions, or not specified
CVE-2026-87114	7.1	0%	Sep 28	Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo Affected: All versions, or not specified
CVE-2026-54369	7.1	0%	Jun 29	acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions Affected: All versions, or not specified
CVE-2026-29518	7.0	0%	May 20	Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write Affected: All versions, or not specified
CVE-2025-54518	7.0	0%	May 15	Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege… Affected: All versions, or not specified
CVE-2026-42965	6.5	0%	May 29	Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation Affected: All versions, or not specified
CVE-2026-1933	6.5	1%	May 27	Samba: missing access check on reparse point operations Affected: All versions, or not specified
CVE-2026-35469	6.5	1%	Apr 16	SpdyStream: DOS on CRI Affected: All versions, or not specified
CVE-2026-39828	6.3	0%	May 22	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh Affected: All versions, or not specified
CVE-2026-83589	6.1	0%	Oct 1	Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect Affected: All versions, or not specified
CVE-2026-42338	6.1	0%	May 12	ip-address: XSS in Address6 HTML-emitting methods Affected: All versions, or not specified
CVE-2026-39835	5.3	1%	May 22	Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh Affected: All versions, or not specified