Red Hat MicroShift 4.19.53 and 4.20.44 Fix Security Flaws
Tech GuruQuick Answer
Red Hat issued MicroShift 4.19.53 and 4.20.44 security updates. Inventory edge clusters and exact branches, apply the matching supported release, validate control-plane and workload behavior, review exceptions, and retain package and change evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory MicroShift edge clusters, exact 4.19 or 4.20 builds, hosts, workloads, operators, owners, disconnected repositories, and maintenance windows. Match each cluster to RHSA-2026:91172 or RHSA-2026:91191; do not apply the 4.19 CVE set or build target to 4.20, or infer compromise from severity. Update the maintained branch to Red Hat build of MicroShift 4.19.53 or 4.20.44 using the supported OpenShift channel and signed content. Confirm running versions and node health, test scheduling, networking, storage and representative workloads, monitor operators and logs, and retain package and change evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat build of MicroShift 4.19 and 4.20 |
|---|---|
| Advisory | RHSA-2026:91172 / RHSA-2026:91191 |
| CVEs | CVE-2026-111943, CVE-2026-33818, CVE-2026-42504, CVE-2026-56858, CVE-2026-56860, CVE-2026-56862 |
| Authoritative release date | 2026-10-29 15:06:04 UTC |
| Authority revision date | 2026-10-29 15:27:44 UTC |
| Affected versions | MicroShift 4.19 builds before 4.19.53 and MicroShift 4.20 builds before 4.20.44 on the advisory-listed Red Hat OpenShift Container Platform channels. |
| Fixed version | Red Hat build of MicroShift 4.19.53 or 4.20.44 on the corresponding supported branch |
| CVSS base score | 6.8-8.1 (CVSS v3.1) |
| CVSS severity | Important |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Red Hat updated MicroShift 4.19 and 4.20 for Go, Kubernetes, and related component vulnerabilities, with different CVE sets on the two maintained branches.
What To Validate Now
- Inventory. Inventory MicroShift edge clusters, exact 4.19 or 4.20 builds, hosts, workloads, operators, owners, disconnected repositories, and maintenance windows.
- Establish applicability. Match each cluster to RHSA-2026:91172 or RHSA-2026:91191; do not apply the 4.19 CVE set or build target to 4.20, or infer compromise from severity.
- Remediate. Update the maintained branch to Red Hat build of MicroShift 4.19.53 or 4.20.44 using the supported OpenShift channel and signed content.
- Validate. Confirm running versions and node health, test scheduling, networking, storage and representative workloads, monitor operators and logs, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Edge and disconnected deployments can have different mirrors and maintenance constraints. Preserve rollback and image provenance while avoiding unsupported cross-branch packages.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
