SB2026072959 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
Published: July 29, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Improper Authorization (CVE-ID: CVE-2026-33186)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to gain access to bypass authorization.
The vulnerability exists due to authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server to bypass authorization.
2) Information disclosure (CVE-ID: CVE-2026-40895)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the redirect handling logic in index.js when following cross-domain redirects. A remote attacker can cause a request to be redirected to an attacker-controlled domain to disclose sensitive information.
Custom authentication headers such as API keys or auth tokens may be forwarded to the redirect target, while only authorization, proxy-authorization, and cookie headers are stripped.
3) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-42154)
CWE-ID: CWE-789 - Uncontrolled Memory Allocation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to memory allocation with excessive size value in the remote read endpoint (/api/v1/read) when processing snappy-compressed request bodies. A remote attacker can send a specially crafted request body to cause a denial of service.
Concurrent exploitation can exhaust available memory and crash the Prometheus process.
4) Use of uninitialized resource (CVE-ID: CVE-2026-45736)
CWE-ID: CWE-908 - Use of Uninitialized Resource
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to use of uninitialized resource in websocket.close() when processing a TypedArray passed as the reason argument. A remote privileged user can pass a crafted TypedArray as the close reason to disclose sensitive information.
The issue is only exploitable through misuse that is unlikely in practice.
5) Code Injection (CVE-ID: CVE-2026-4800)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.
Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().
Remediation
Install update from vendor's website.