Loading story…
Red Hat released an Important security update for OpenShift Container Platform (OCP) 4.18.2 that fixes CVE-2024-8676, a CRI-O flaw allowing a checkpoint restore for a pod in one namespace to be triggered from another namespace. The cross-namespace action can violate pod security contexts, creating a container-isolation and authorization risk; Red Hat also issued remediation advisories for affected OCP 4.15, 4.16, 4.17, and 4.18 releases.
The OCP 4.18.2 advisory, RHSA-2025:1908, also resolves CVE-2024-11218, a Podman/Buildah race condition that could enable container escape while building a malicious Containerfile with --jobs=2. Red Hat advised OCP 4.18 customers to update packages and accompanying images through their supported release channel across RHEL 8 and RHEL 9 deployments on x86_64, IBM Power, IBM Z/LinuxONE, and ARM64.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-rated RHSA-2025:9765, releasing OpenShift Container Platform 4.16.43 updates and container images for RHEL 9. The release fixes CVE-2024-8676, CVE-2024-45497 in the OpenShift build process, and CVE-2025-4802 in glibc; Red Hat advised OCP 4.16 users to upgrade through their release channel.
Red Hat published Important-rated advisory RHSA-2025:1908 for OpenShift Container Platform 4.18.2, remediating CVE-2024-8676, which permitted a CRI-O checkpoint restore to be triggered across namespaces. The update also addressed CVE-2024-11218 and Red Hat advised OCP 4.18 users to upgrade packages and images.
Red Hat published Moderate-rated advisory RHSA-2025:0648 for OpenShift Container Platform 4.15.44, remediating CVE-2024-8676 in CRI-O, which allowed checkpoint restoration to be triggered from another Kubernetes namespace. The update supplied CRI-O 1.28.11-7.rhaos4.15.gitc4c0556 packages for RHEL 8 and RHEL 9, and Red Hat advised OCP 4.15 users to upgrade packages and container images.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcedocs.openshift.com
Open sourcedocs.openshift.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **OpenShift Container Platform 4.13.56** through advisory **RHSA-2025:2701**, an Important security and bug-fix update for OCP 4.13 deployments. The release refreshes platform container images and remediates flaws in Buildah, Podman, rsync, runc, `golang.org/x/net/html`, the Linux kernel, and libxml2, including vulnerabilities that could enable container breakout or arbitrary directory mounts. The update applies to OCP 4.13 on RHEL 8 and RHEL 9 for x86_64, IBM Power, IBM Z/LinuxONE, and ARM64 systems. Red Hat advises affected customers to upgrade to 4.13.56 through the applicable OpenShift release channel using the OpenShift CLI or web console.
Aug 27, 2026
Red Hat released multiple security updates for **OpenShift Container Platform 4.12**, including versions **4.12.84** and **4.12.87**, and urged customers to upgrade through the appropriate release channel using the OpenShift CLI or web console. The advisories cover updated RPMs and container images across **RHEL 8** and **RHEL 9** deployments for `x86_64`, `ppc64le`, `s390x`, and `aarch64`, and address several flaws in bundled components. Among the issues fixed are `runc` container escape vulnerabilities **CVE-2025-31133**, **CVE-2025-52565**, and **CVE-2025-52881**, as well as the `grub2` use-after-free flaw **CVE-2025-61662**. A broader OpenShift 4.12 advisory also included fixes for vulnerabilities in **podman**, **expat**, **sssd**, `runc`, and **bind**. Red Hat-linked bug reports describe **CVE-2025-4953** as a Podman image-build issue that could temporarily expose sensitive build-context files to unprivileged local users, and **CVE-2025-11561** as an SSSD Kerberos configuration weakness that could let attackers who can alter Active Directory attributes impersonate privileged accounts on AD-joined Linux systems. Although the notices were labeled **Important** in the portal, Red Hat Product Security rated the OpenShift updates' overall impact as **Low**.
Aug 20, 2026
Red Hat released Important security updates for Red Hat OpenShift Container Platform and RHEL 9 Podman and Buildah deployments to remediate container-stack vulnerabilities, notably **CVE-2024-9675** and **CVE-2024-9676**. CVE-2024-9675 can permit arbitrary directory mounts through Buildah, while CVE-2024-9676 is a `containers/storage` symlink-traversal flaw affecting Podman, Buildah, and CRI-O. When a malicious image runs with automatically assigned user namespaces, the latter can cause container creation to block indefinitely or CRI-O to exhaust memory and crash; limited error-message disclosure is also possible to the user operating the affected software. Affected OpenShift releases include 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, and 4.18, with related advisories also addressing flaws such as Dockerfile bind-propagation validation, FIPS crypto-policy mounting, Distribution JWT signing-key injection, and denial-of-service issues in Go, BIND, libxml2, GRUB2, and the Linux kernel. Red Hat advises OpenShift customers to update clusters through their supported release channels using the CLI or web console, and RHEL 9 users to deploy the updated Podman or Buildah packages for their supported architecture and subscription channel.
Aug 26, 2026