Red Hat Releases OpenShift 4.22.22 Security Update
Tech GuruQuick Answer
Check OpenShift 4.22 clusters for the supported 4.22.22 update. Validate channel eligibility and operator health, plan node maintenance, and retain release-image, rollout and workload-test evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Record OpenShift version, update channel, architecture, release-image digest, operator conditions, node roles and maintenance owners. Match the documented versions and feature prerequisites to the deployment. Advisory scope is OpenShift Container Platform 4.22; it does not establish a single affected range for every component. Use the supported OpenShift CLI or console update path to 4.22.22 after checking channel eligibility and prerequisites. Follow Red Hat maintenance sequencing for cluster and node rollout. Verify the cluster release, node rollout and operator health; test ingress, authentication, storage and representative workloads. Retain release-image, rollout, reboot and service-test records.
Last verified: 2026-11-07 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenShift Container Platform 4.22 |
|---|---|
| Advisory | RHSA-2026:95346 |
| CVEs | CVE-2025-31936, CVE-2026-111497, CVE-2026-12080, CVE-2026-14456, CVE-2026-18798, CVE-2026-19630, CVE-2026-26007, CVE-2026-50252, CVE-2026-52929, CVE-2026-63072, CVE-2026-63076, CVE-2026-64597, CVE-2026-68376, CVE-2026-71226, CVE-2026-77206, CVE-2026-77207, CVE-2026-77214, CVE-2026-80824, CVE-2026-8458, CVE-2026-84782, CVE-2026-8932, CVE-2026-89777, CVE-2026-90003, CVE-2026-90011, CVE-2026-94300, CVE-2026-94453, CVE-2026-96888, CVE-2026-97313, CVE-2026-98222, CVE-2026-98320, CVE-2026-98364, CVE-2026-98432, CVE-2026-98466, CVE-2026-98725 |
| Authoritative release date | 2026-11-06 18:10:52 UTC |
| Authority revision date | Initial/last updated version: 2026-11-06 18:10:52 UTC. CSAF generated: 2026-11-06 22:24:26 UTC; generation alone is not a material revision. |
| Affected versions | Advisory scope is OpenShift Container Platform 4.22; it does not establish a single affected range for every component. |
| Fixed version | OpenShift Container Platform 4.22.22 |
| CVSS base score | 4.7–9.8 (official per-CVE CVSS v3.1 scores) |
| CVSS severity | Medium to Critical (CVSS); Critical (advisory rating) |
| Exploitation status | Not confirmed by the cited authority; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| Scope and action | Red Hat releases OpenShift Container Platform 4.22.22 with fixes for 34 CVEs in the advisory-listed components and RHCOS builds. |
|---|---|
| Date basis | 2026-11-06 18:10:52 UTC |
What Changed
Red Hat releases OpenShift Container Platform 4.22.22 with fixes for 34 CVEs in the advisory-listed components and RHCOS builds.
What To Validate Now
- Inventory. Record OpenShift version, update channel, architecture, release-image digest, operator conditions, node roles and maintenance owners.
- Establish applicability. Match the documented versions and feature prerequisites to the deployment. Advisory scope is OpenShift Container Platform 4.22; it does not establish a single affected range for every component.
- Remediate. Use the supported OpenShift CLI or console update path to 4.22.22 after checking channel eligibility and prerequisites. Follow Red Hat maintenance sequencing for cluster and node rollout.
- Validate. Verify the cluster release, node rollout and operator health; test ingress, authentication, storage and representative workloads. Retain release-image, rollout, reboot and service-test records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not treat component CVSS scores as a deployment exposure finding. Check upgrade prerequisites and backup/rollback plans.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
