Red Hat OpenShift 4.20–4.22 Updates Address Multiple Flaws

Quick Answer

Red Hat's September 22 OpenShift updates cover releases 4.20.39, 4.21.34 and 4.22.15, plus separate 4.22 CNF IBU content. Select the supported update in the cluster's release channel and review the matching RPM, image and extras advisories; 4.21 alone is not a fixed release identifier.

Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	OpenShift Container Platform 4.20, 4.21, and 4.22 package and image streams
Advisory	RHSA-2026:68547 / RHSA-2026:68553 / RHSA-2026:68546 / RHSA-2026:68552 / RHSA-2026:69922 / RHSA-2026:68543 / RHSA-2026:68538 / RHSA-2026:68541 / RHSA-2026:68550
CVEs	CVE-2026-16221, CVE-2026-18446, CVE-2026-25681, CVE-2026-27136, CVE-2026-33814, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39835, CVE-2026-41178, CVE-2026-42502, CVE-2026-42504, CVE-2026-45819, CVE-2026-46597, CVE-2026-55204, CVE-2026-56862, CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172, CVE-2026-82417, CVE-2026-84292, CVE-2026-84394
Authoritative release date	RHSA-2026:68547: 2026-09-22T06:38:03+00:00 (CSAF initial release) RHSA-2026:68553: 2026-09-22T06:42:30+00:00 (CSAF initial release) RHSA-2026:68546: 2026-09-22T07:56:42+00:00 (CSAF initial release) RHSA-2026:68552: 2026-09-22T08:09:07+00:00 (CSAF initial release) RHSA-2026:69922: 2026-09-22T08:28:23+00:00 (CSAF initial release) RHSA-2026:68543: 2026-09-22T08:32:12+00:00 (CSAF initial release) RHSA-2026:68538: 2026-09-22T09:08:03+00:00 (CSAF initial release) RHSA-2026:68541: 2026-09-22T09:49:41+00:00 (CSAF initial release) RHSA-2026:68550: 2026-09-22T10:05:56+00:00 (CSAF initial release)
Authority revision date	RHSA-2026:68547: 2026-09-22T06:40:42+00:00 (CSAF revision history) RHSA-2026:68553: 2026-09-22T06:45:14+00:00 (CSAF revision history) RHSA-2026:68546: 2026-09-22T07:59:30+00:00 (CSAF revision history) RHSA-2026:68552: 2026-09-22T08:12:19+00:00 (CSAF revision history) RHSA-2026:69922: 2026-09-22T08:28:29+00:00 (CSAF revision history) RHSA-2026:68543: 2026-09-22T08:34:44+00:00 (CSAF revision history) RHSA-2026:68538: 2026-09-22T09:08:03+00:00 (CSAF revision history) RHSA-2026:68541: 2026-09-22T09:52:24+00:00 (CSAF revision history) RHSA-2026:68550: 2026-09-22T10:05:56+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates.
Affected versions	The exact entitled OpenShift Container Platform 4.20, 4.21, and 4.22 package and image streams builds before the branch-specific package, image, or digest listed by Red Hat.
Fixed version	OCP 4.20.39: image RHSA-2026:68541; extras :68543. OCP 4.21.34: images :68546; packages :68538; extras :68547. OCP 4.22.15: images :68552; packages :68550; extras :68553. OCP 4.22 CNF IBU: separately match lifecycle-agent/recert images to RHSA-2026:69922. Use the architecture-specific image digests and package builds in those advisories; the generic branch label is not a fixed-build identifier.
CVSS base score	6.1 / 7.5 / 8.1 / 8.8 (CVSS v3.1)
CVSS severity	Medium to High
Exploitation status	The nine OpenShift advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred.

What Changed

The 24 CVEs below are the combined coverage of nine advisories, including URI-parsing policy bypasses, Go dependency flaws and HAProxy denial of service. They do not all apply to every component. Cluster release images, client/extras packages and the CNF IBU lifecycle-agent/recert images require their own applicability checks.

What To Validate Now

1. Inventory. Locate OpenShift Container Platform 4.20, 4.21, and 4.22 package and image streams deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled OpenShift Container Platform 4.20, 4.21, and 4.22 package and image streams builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
3. Remediate. Apply the supported release-channel update for the installed branch and its applicable packages/extras. Match separately deployed CNF IBU images to :69922; do not assume an OCP version change alone updates all of them.
4. Validate. Confirm the resulting cluster release and release-image digest, operator/node health and completion of the rollout. Check updated client/extras RPMs and any IBU operator images separately, then exercise representative application traffic, storage and recovery workflows.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• RHSA-2026:68547
• RHSA-2026:68553
• RHSA-2026:68546
• RHSA-2026:68552
• RHSA-2026:69922
• RHSA-2026:68543
• RHSA-2026:68538
• RHSA-2026:68541
• RHSA-2026:68550

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.