Loading story…
Red Hat will require every Red Hat Operator to ship with Kubernetes NetworkPolicies beginning in February 2027 under updated OpenShift hardening requirements. The policies are intended to constrain network communication for operator-managed workloads and make operator deployments conform to the platform’s security baseline.
Meeting the requirement depends on updates to Operator Lifecycle Manager (OLM) across supported OpenShift releases, meaning affected clusters must be upgraded before operators containing NetworkPolicies can be upgraded. Red Hat is also developing OLMv1 support for layered operators to package and deploy tailored NetworkPolicies within OLM bundles, tracked as OCPBUGS-60521.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Operator Lifecycle Manager was updated across supported OpenShift versions to allow Operators to include Network Policies. Red Hat said clusters must be upgraded to obtain this support, without specifying the required target version.
Red Hat stated that every Red Hat Operator must ship with Network Policies under OpenShift hardening requirements. The source identifies February 2027 as the policy’s future start date, but does not date the statement itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
issues.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released security updates across OpenShift Container Platform (OCP), OpenShift Serverless, Service Mesh, API for Data Protection (OADP), Advanced Cluster Security, Virtualization, Distributed Tracing, Cryostat, and related operators. The advisories remediate multiple Go defects, led by **CVE-2022-41723**, an HTTP/2 HPACK-decoding flaw that lets crafted streams consume excessive CPU through quadratic processing and cause denial of service. Updates also address **CVE-2022-41717**, where oversized HTTP/2 header keys can allocate roughly 64 MiB per connection, and **CVE-2022-41715**, which allows certain regular expressions to drive disproportionate memory use during parsing. Several releases additionally fix **CVE-2023-25173** in containerd, which could allow a user with container access to manipulate supplementary-group permissions and bypass primary-group restrictions within that container. OCP 4.13 updates also remediate the FIPS-mode issue tracked as **CVE-2023-3089**, Kubernetes privilege-escalation and runc mount-race issues, plus other Go resource-exhaustion and template-processing flaws. Red Hat advises affected customers to upgrade packages and container images through supported OpenShift release channels; environments using vulnerable standalone containerd versions should upgrade to 1.6.18 or 1.5.18 and recreate containers.
Aug 28, 2026
Red Hat released security updates across OpenShift Container Platform (OCP) versions 4.12, 4.14, 4.15, and 4.16 to address denial-of-service vulnerabilities in bundled components. Key issues include **CVE-2023-39325**, the Go `net/http`/`x/net/http2` flaw associated with the HTTP/2 Rapid Reset attack and related to **CVE-2023-44487**, which lets unauthenticated clients repeatedly create and reset HTTP/2 streams to exhaust server resources. Red Hat rates CVE-2023-39325 as Important, CVSS 7.5, and notes CISA identified active exploitation. The releases also remediate **CVE-2023-47108**, in which unbounded-cardinality metrics in OpenTelemetry's `otelgrpc` component can cause resource exhaustion, alongside other version-specific fixes such as OpenTelemetry `otelhttp` DoS, `word-wrap` regular-expression DoS, Python temporary-directory path traversal, XSS, Rekor out-of-memory, and SSH prefix-truncation issues. Organizations should upgrade affected clusters through their supported OCP release channels using the web console or OpenShift CLI; where patching CVE-2023-39325 cannot be immediate, Red Hat recommends reducing the HTTP/2 server stream-concurrency setting as a mitigation.
Aug 28, 2026
Red Hat released an **Important** security update for OpenShift Container Platform (OCP) 4.18.2 that fixes `CVE-2024-8676`, a CRI-O flaw allowing a checkpoint restore for a pod in one namespace to be triggered from another namespace. The cross-namespace action can violate pod security contexts, creating a container-isolation and authorization risk; Red Hat also issued remediation advisories for affected OCP 4.15, 4.16, 4.17, and 4.18 releases. The OCP 4.18.2 advisory, `RHSA-2025:1908`, also resolves `CVE-2024-11218`, a Podman/Buildah race condition that could enable container escape while building a malicious Containerfile with `--jobs=2`. Red Hat advised OCP 4.18 customers to update packages and accompanying images through their supported release channel across RHEL 8 and RHEL 9 deployments on x86_64, IBM Power, IBM Z/LinuxONE, and ARM64.
Aug 27, 2026