Loading story…
Red Hat released multiple security updates for OpenShift Container Platform 4.12, including versions 4.12.84 and 4.12.87, and urged customers to upgrade through the appropriate release channel using the OpenShift CLI or web console. The advisories cover updated RPMs and container images across RHEL 8 and RHEL 9 deployments for x86_64, ppc64le, s390x, and aarch64, and address several flaws in bundled components. Among the issues fixed are runc container escape vulnerabilities CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881, as well as the grub2 use-after-free flaw CVE-2025-61662.
A broader OpenShift 4.12 advisory also included fixes for vulnerabilities in podman, expat, sssd, runc, and bind. Red Hat-linked bug reports describe CVE-2025-4953 as a Podman image-build issue that could temporarily expose sensitive build-context files to unprivileged local users, and CVE-2025-11561 as an SSSD Kerberos configuration weakness that could let attackers who can alter Active Directory attributes impersonate privileged accounts on AD-joined Linux systems. Although the notices were labeled Important in the portal, Red Hat Product Security rated the OpenShift updates' overall impact as Low.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat announced OpenShift Container Platform 4.12.87 as a bug fix and security update for the 4.12 stream. The release updated packages and container images and fixed runc flaws CVE-2025-31133 and CVE-2025-52565 plus grub2 flaw CVE-2025-61662.
Red Hat published RHSA-2026:0316 for OpenShift Container Platform 4.12.84 as a bug fix and security update with refreshed packages and container images. The advisory included fixes for CVEs affecting podman, expat, sssd, runc, and bind, and Red Hat rated the overall impact as Low.
Red Hat issued RHSA-2026:0315 for OpenShift Container Platform 4.12.84 with updated RPM packages and images addressing runc vulnerabilities CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881. Red Hat rated the update's security impact as Low and advised 4.12 users to upgrade.
A Red Hat Bugzilla entry documented CVE-2025-11561 in SSSD, describing how the default Kerberos configuration on AD-joined Linux systems could allow attackers who can modify AD attributes to impersonate privileged accounts.
A Red Hat Bugzilla entry documented CVE-2025-4953 in Podman, where a build context directory could remain accessible for 300 seconds during image builds, allowing an unprivileged host user to access exposed files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates for OpenShift Container Platform (OCP) release streams 4.13 through 4.22, including **4.19.43**, **4.20.34**, **4.21.29**, and **4.22.10**. The Important-rated updates deliver refreshed packages and container images for x86_64, s390x, ppc64le, and aarch64 deployments, including supported RHEL 8 and RHEL 9 variants. OCP 4.13.70 was rated Low, although its advisory lists fixes affecting the Linux kernel, OpenSSL, and SSSD. The fixes address vulnerabilities in the Linux kernel, Samba, SSSD, ICU, dnsmasq, OpenSSH, libarchive, rsync, Unbound, Vim, and other bundled components. Notable SSSD issues include **CVE-2026-14474**, which can enable privilege escalation through the sudo LDAP provider's directory-wide sudoRole search, and **CVE-2026-14476**, a GPO-cache path traversal flaw that can permit Kerberos authentication bypass. Red Hat advised administrators to upgrade affected clusters through their appropriate OpenShift release channels using the web console or OpenShift CLI.
Aug 25, 2026
Red Hat released a series of **OpenShift Container Platform 4.12** security and bug-fix updates, including versions **4.12.91**, **4.12.92**, **4.12.93**, and **4.12.96**, and urged customers to upgrade through their normal release channels. The updates affect deployments across **x86_64, ppc64le, s390x, and aarch64** on **RHEL 8** and **RHEL 9**, and primarily ship as refreshed container images, with some releases also including updated packages. Although several advisories were labeled **Important** or even **Critical**, Red Hat Product Security rated the overall impact of these OpenShift 4.12 releases as **Low**. The fixes span multiple components and vulnerabilities, including **OpenSSH**, **jq**, **sudo**, **nghttp2**, **libxslt/libxml2**, the **Linux kernel**, and virtualization-related flaws such as **CVE-2026-53359**, a KVM x86 shadow paging use-after-free issue, as well as **CVE-2025-10263**, an Arm processor privilege-escalation or information-disclosure flaw. Earlier releases also addressed **CVE-2026-35385**, **CVE-2026-39979**, **CVE-2026-40164**, **CVE-2026-43037**, **CVE-2026-1519**, **CVE-2026-46331**, and **CVE-2026-46243**. One advisory for **4.12.91** contained conflicting text stating `Security Fix(es): None` while simultaneously listing multiple CVEs, but Red Hat still recommended that all OpenShift 4.12 users apply the updates as they become available.
Aug 25, 2026
Red Hat shipped a series of OpenShift Container Platform security updates across supported release streams, including **4.12.86**, **4.13.64**, **4.17.50**, and **4.19.25**, to remediate multiple flaws in bundled components. The fixes cover `CVE-2025-9230` in OpenSSL, an out-of-bounds read and write in CMS password-based encryption handling that can crash applications or corrupt memory; `CVE-2025-6176` in Scrapy, where brotli decompression can trigger denial of service through excessive memory consumption; `CVE-2025-52881` in `runc` and `opencontainers-selinux`, which can enable container escape and denial of service; and `CVE-2025-61726` in Go's `net/url` package, which can cause memory exhaustion during query parsing. Red Hat rated the OpenShift 4.17 and 4.19 releases as **Important** because of the container escape and resource-exhaustion risks, while updates for 4.12 and 4.13 were published with **Low** security impact despite bundling fixes for OpenSSL, Scrapy/brotli, libssh, glib, and libpng issues. The advisories affect deployments on **RHEL 8** and **RHEL 9** across `x86_64`, `ppc64le`, `s390x`, and `aarch64`, and Red Hat urged customers to upgrade through the appropriate OpenShift release channels using the CLI or web console.
Aug 20, 2026