4.14.75

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.14.75-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Pending (2 retries) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-ovn-serial
- aws-ovn-upgrade-micro Succeeded periodic-ci-openshift-release-main-ci-4.14-e2e-aws-ovn-upgrade
- aws-sdn-upgrade-4.14-micro Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-sdn-upgrade
- azure-ovn-upgrade-4.14-micro Pending (1 retry) periodic-ci-openshift-release-main-ci-4.14-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.14-fips-payload-scan
- gcp-ovn-rt-upgrade-4.14-minor Failed (1 retry) periodic-ci-openshift-release-main-ci-4.14-upgrade-from-stable-4.13-e2e-gcp-ovn-rt-upgrade
  - Attempt 1 Failed
  - Attempt 2 Failed
- hypershift-ovn-conformance Failed (1 retry) periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-ovn-ipv6
- metal-ipi-sdn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.14-e2e-metal-ipi-sdn-ipv4

Upgrades from:

Untested upgrades: 4.13.23, 4.13.24, 4.13.25, 4.13.26, 4.13.27, 4.13.28, 4.13.29, 4.13.30, 4.13.31, 4.13.32, 4.13.33, 4.13.34, 4.13.35, 4.13.37, 4.13.38, 4.13.39, 4.13.40, 4.13.41, 4.13.42, 4.13.43, 4.13.44, 4.13.45, 4.13.46, 4.13.48, 4.13.49, 4.13.51, 4.13.52, 4.13.53, 4.13.54, 4.13.55, 4.13.56, 4.13.57, 4.13.58, 4.13.59, 4.13.60, 4.13.61, 4.13.62, 4.13.63, 4.13.64, 4.13.65, 4.13.66, 4.13.67, 4.13.68, 4.14.10, 4.14.11, 4.14.12, 4.14.13, 4.14.14, 4.14.15, 4.14.17, 4.14.18, 4.14.19, 4.14.20, 4.14.21, 4.14.22, 4.14.23, 4.14.24, 4.14.25, 4.14.26, 4.14.27, 4.14.28, 4.14.29, 4.14.30, 4.14.31, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.14.36, 4.14.37, 4.14.38, 4.14.39, 4.14.4, 4.14.40, 4.14.41, 4.14.42, 4.14.43, 4.14.44, 4.14.45, 4.14.46, 4.14.47, 4.14.48, 4.14.49, 4.14.5, 4.14.50, 4.14.51, 4.14.52, 4.14.53, 4.14.55, 4.14.56, 4.14.57, 4.14.58, 4.14.59, 4.14.6, 4.14.60, 4.14.61, 4.14.62, 4.14.63, 4.14.64, 4.14.65, 4.14.66, 4.14.67, 4.14.68, 4.14.69, 4.14.7, 4.14.70, 4.14.71, 4.14.8, 4.14.9

Loading changelog, this may take a while ...

Changes from 4.14.54

Created: 2026-09-30 18:24:39 +0000 UTC

Image Digest: sha256:15fc6659721704443287f3783e1eac991755dadb376891867f52453a147e048b

Components

Kubernetes 1.27.16
Red Hat Enterprise Linux CoreOS upgraded from 414.92.202507201608-0 to 414.92.202609282130-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

agent-installer-utils git b3fa10c2 sha256:767f34d7cba4c7052d4cd6c729f931e7619584cebaef08e7616aaac7a8782f1d
alibaba-cloud-csi-driver git 3dc363d3 sha256:5639aace59fbcc1cdb4ab83da8896e60eaf6065c83e51805e278491ec97986dc
alibaba-disk-csi-driver-operator git 8853e6ef sha256:e6c24cc00c0a7a3d9a718cedebb945cbd247b0a409e836d476ec2aff6c16ef69
alibaba-machine-controllers git 27f105d3 sha256:e947f2ccd0ea7335a341b51ee5c6c970da560b04c93039eac9b9d697430c5df9
apiserver-network-proxy git f56c606a sha256:d45d95b4664b5369d746e1bc834b1cc8b6221667a7ca5ef455ef045913ed4657
aws-cloud-controller-manager git 9a7820e8 sha256:8dffb7e514619803c2d4ed8ba6185b6525c16a1eef2bea58045aaa0905da311f
aws-ebs-csi-driver git 4622deec sha256:efb8af794bc90d99b006329dabcf2402679db75009245320495be8caae175315
aws-pod-identity-webhook git 2c864ca0 sha256:029be0311848cafdd201ec3ff26122f032e2c303a802bc583362594659224012
azure-disk-csi-driver git 6d3558a3 sha256:24d722de7b81df72914f223f3d4823f22f5963da5b8fcd9abe871246d3bbf731
azure-disk-csi-driver-operator git 91893576 sha256:06fd680d032a4bbba9b1d978d6213976051a951cfc6de7f743512d59479ce197
azure-machine-controllers git d526284e sha256:ff1fded36c4f2604a53a21746454de4e43e20874d05f8bbaab6d7c1ad6412b08
azure-workload-identity-webhook git 2cb82019 sha256:1b6c8eb6eb85922a3de98e69b4044010592f64002bd8858ff1de71c6d6af48c2
baremetal-operator git 483d0191 sha256:afc05c49b6f1bc119fd8b1cd08d42065cf3171f202345222cba5d15d8c004e14
baremetal-runtimecfg git 0ba9e555 sha256:ec9d6e9cda3256104d83c4b6b4b5cfd91efbc5206c20046673e2a48df75fabd6
cli git 44b3ac26 sha256:8c14acb825df42789c9eb1efe2222a8d3ca0582a4cd73809928171a978afb48d
cli-artifacts git 44b3ac26 sha256:b7715390d7ef8054c2faaf338f0b67e554d4c4a4b81d88ce5325201d52db3553
cloud-network-config-controller git 1bd04641 sha256:862833cf54a0a85d5398750b186d2978701179abdfba23295bc01f2559357f08
cluster-authentication-operator git 9203d4d5 sha256:115a6c16977a12e9111b87ace59e4a6a4469437f90d15fd5719c8ebccc2f44df
cluster-autoscaler git d030dbaa sha256:925aa34819edd88a053525596056b0a3593f3cc9fc10e992ffe6efe08a0e121c
cluster-bootstrap git 93fba13f sha256:8cd1d03bd32d3d5f8c61ebc8fd92ac4b5d6cc62fab5817275849a9507eede370
cluster-config-operator git 2378670a sha256:1ac52bcc74582c6ba1146297b7f444b4b89cabc48cb2be11be2096bbd9fe0b9c
cluster-control-plane-machine-set-operator git 783d9dd1 sha256:ee49437ad7d4957be9cbd9d5c7e4eada12cb5d1174c90ca01752eee58a61ad96
cluster-csi-snapshot-controller-operator git d4a11625 sha256:29ea3c5381c45749e5909781d7c25e1ce58d0fb34c05706d7b998e84d684dda6
cluster-dns-operator git 0164e3c4 sha256:eeb2167fcd29b50b158445a80a587da97c9c8ba0d475c8200349c50419777fcc
cluster-kube-cluster-api-operator git b287d08b sha256:1bf80754f3e057451945ae453030b40fed3da83c9db09420495a9a44b808ee16
cluster-kube-controller-manager-operator git 4e059638 sha256:54e45cff4153eddef76cf3117f0838904f8f314c73a3423381ae82e8db32eac5
cluster-machine-approver git 38a758d0 sha256:66259101cd1ab8e3331ef4ecad1e87e63cd87d3386db1e5e9b8ac4c738a8547d
cluster-node-tuning-operator git 5511c8df sha256:7dd378ff536bbb6617c807f6ca543654f093c96ad176239dbb40f3dd8543f4d2
cluster-openshift-controller-manager-operator git 09d62091 sha256:4b51c495cf9cd5ce1088a45319a24575ee8217d85a029ea8025a66cf09f266ae
cluster-platform-operators-manager git 08fb27e7 sha256:c980f3eacce340b1075e3d52c475acfdc2d9cc5c868f9a96579cc90f90e31d1f
cluster-policy-controller git 219f6f6f sha256:e4377511577a5750b6068166189db20c370a6dcc59c780431c38969179c2c324
cluster-update-keys git 1a7a6e22 sha256:b0023427112dae5733415c6fb9fc49a3ca722e274ad8784cac05365d36218a3e
cluster-version-operator git a1bf9301 sha256:e8be1f345d36c4be358b7424e7a906b99824717755402aab6aa742952f76ac26
configmap-reloader git 716a0c33 sha256:381b02648f8dbc9f89752950e1817159a3d93a177e792a0d3d1f1552c4376a07
csi-driver-shared-resource-operator git c273cd52 sha256:ddd155db4ed8956e78d9ad369a2a71a731ca3a82b4b98a5f1a989a56811af8ec
csi-external-attacher git 06e8ce0d sha256:3f8e5c1c31d1dd183d7ab45cc572c84c56fe6b7234324608f0ec1eab1bd4a5bf
csi-external-provisioner git e18ed7f0 sha256:dbbe64b189b7225ced291967ff325e803e290fdd2f3614efed4752735336eca4
csi-external-resizer git 59a701a4 sha256:24f13f58bd0bf3ba7dfb7ef36b82fef385eb7a8aeb97f3776002de7d0981b723
csi-external-snapshotter git a6834536 sha256:53db02cc74deecfb0028deb95ef584c9986f821c9dd1b67e9daba491a05ec089
csi-livenessprobe git a9bcbde1 sha256:28414d88c7a3bf1848cf22dc58ef64eb45a253c2aeca7c13b822549422dc78fc
csi-node-driver-registrar git 9dcaa7f5 sha256:cc46f6f326cc7e9cacd6f97cc94f903d8687eeeac0a804e3d23ef1e115b64830
csi-snapshot-controller git a6834536 sha256:d79f426a3b139bf1395e0d4a5889089d3bf07be528165111aa84111b878b570a
csi-snapshot-validation-webhook git a6834536 sha256:2cb95263f0a8baf60e4658e6f0d1e41deba9cbb4d5440186145be786f1fa35a4
deployer git 44b3ac26 sha256:6e1a492854dbe4d84f4c22531ccdcfd0807f49861c9c24c5c876722a3eec2403
docker-registry git ce0483f1 sha256:6157ef651d92c3cde3260701ca6b2f73aa554baee714cfb8f03c51312e0c0850
driver-toolkit git cafed17b sha256:6ac2db8ec70cfc4614b89c387f35e1e40d01f19ceb1a948491f6065c7c840e1f
egress-router-cni git 96f2f54f sha256:574ad05cf7cec9424f40d3038fc026b31feb305fa1278d5b21d12ff603116dfc
etcd git 5ed5044c sha256:571ff728fc4e2f6135317699794b95ff679ca26a2d0e29c85fe420de7309010f
gcp-cloud-controller-manager git 09e96a91 sha256:0794daf8227c29cca54a953017f37a663649e1dd5c1e9ef13f0bb9fe60240013
gcp-pd-csi-driver git 8a626fe5 sha256:c271ca195fec26a0a6fcdc634129017ac3acc4f4f6e5d4d5dff1f148e3363d63
gcp-pd-csi-driver-operator git 95d55a04 sha256:ea2034a2bab2fbda1758179175f2c3d67f78aa1ccf3f48e36639c84f11dff371
ibm-cloud-controller-manager git f39488c5 sha256:a68e327859ea8f04bdaa448c92aca86224960bf17742536f7908e0759e6a1890
insights-operator git acc99f55 sha256:cfd623a12b62696efa3d905081c13be5d5e0b09922d4cd3bb179d8324b261494
ironic-static-ip-manager git 1b194fd1 sha256:89cffbe720029cadadc870dc35908739c1be195bd9f8581663f87d42d2bd04f1
k8s-prometheus-adapter git 801a912b sha256:b0a26c19ef22a6abb05563ad83dc583cf31c3bfcfb4e28184f484b02a9cb1200
keepalived-ipfailover git 03e5f407 sha256:e8537db5b97a127d4cc9d538fe93f9d23b82ce3fa8d63811e162f67321ec150c
kube-proxy git 1f611c53 sha256:ccc2f6af53ed8d0863275f0d621f01366cf1e1f05684a74be827a8b0369adfa6
kube-rbac-proxy git b8b82595 sha256:0fecffcc6ed2a4c8552069966bc8a37efcb38847274d852ddd2a2f352bcb945e
kube-state-metrics git db0c5499 sha256:a8b03a73226865e082747b0515b8badea7c232b2cf405a42483f452084d0bbc8
kuryr-cni git 8926a294 sha256:01210c297d2a6201d5e0044f32f6264fe1db0c48b4749c56e5b7213fb082732a
kuryr-controller git 8926a294 sha256:f8ca3b44b0aa9e51f5a150c7141ac91f7a54dc80444c7a9af3888a1d5a142d25
machine-config-operator git 00b2e0b1 sha256:c46322f21ef3566899723977a347cf532c63045ad88ae2504ab3855a90b356e9
machine-os-content sha256:9809d75c846503c3100132006c491708b6ffe102becfcfd356607382e63f0133
multus-networkpolicy git f670647c sha256:091b19a6d772795a61fdcab005a5adbd01a8c147fd7b64dec18a82d7af558fe2
multus-route-override-cni git 5965fed6 sha256:0847b8dd5e948bab8129c1fe96981652fde25897aeb3b8ff8c181caa7e8a6dc7
multus-whereabouts-ipam-cni git f95487b0 sha256:03ba4c9959dc7e16fd8140dc435d499fe4e9fcb35333d4e4806ac0058b9cc1d5
must-gather git b8585ca8 sha256:2df13d439c17d77eed895e5ffdfcf77ae0cccffa16b0c3b65533b4b74a02a1cb
network-interface-bond-cni git 29f61f6b sha256:783c206bf369035ac2229149715f7f46739df6eafefce914f81f2cefa2066585
network-tools git e79d8173 sha256:e6998a494754858518b8dc4b116f4a042ed2722602be5826c7a602e3fa9ebfff
nutanix-cloud-controller-manager git 8930f295 sha256:fc96f95746c16f4f27265075a96a78ad7392996c883874a850db1f100aa66273
nutanix-machine-controllers git c0661680 sha256:cbbfa461f80d24cfe7bd3d3c60ccbdb97470d5eb59c88fb4238eeec6e524c4f3
oauth-server git 35f4739f sha256:48e2bd7ca4eaa8907957cfeb3276ed81359af7a9058e1898b4931ff4ad27809e
oc-mirror git 056043d1 sha256:86d496ee1725850bbfa9d8c070b7867a6aed94e74bec374be8a9c507d81b4ed2
olm-catalogd git a333cb0b sha256:5c72f75e555c05399d87349ffe81562d955c10f9e595ec19147e4aa8c3f08f58
olm-operator-controller git fb6fb278 sha256:8fa0b78819d87c743b3b084ba0b7cfa3741ffbe7f2e0aea005f57eb71d008473
olm-rukpak git c9409c62 sha256:30c54d44ee207cbc893e5ce231ff3fca0f8dd5b683f3a72321fc71f041d43fec
openshift-controller-manager git 1c76570b sha256:47ae5a72a3fdc471bdc637bf98704ac9da1259746e687458045ae9b73536f3cf
ovirt-machine-controllers git 5d708631 sha256:8d3dc90e44f314f3f6853f63583d1fb67ca0afd6cbd6e0d22574e3cc90664d70
powervs-block-csi-driver git 988f7109 sha256:90b03cf86febaa64df3c86fe4dca06c5502c52ab4dcb55e3b504142fd9bb3191
powervs-cloud-controller-manager git 19cf1d3f sha256:bac2b5724357c7bd2b7975edb2bd1c90d5518075db0a8a9a7ba9f28566bc959e
prometheus-config-reloader git a4b845a7 sha256:242b3e44045df6a5c948db05ed05db5a839b89d05a6c2b8a27510c94a913cb8d
prometheus-operator git a4b845a7 sha256:68bc18e3b9ed810a83fb5692423907d8c8ab83757fcd29748080cf31ae45d0a9
prometheus-operator-admission-webhook git a4b845a7 sha256:b1a91f72e38a38c558c7b4f5aff93c9f14272cf82d022b8d06e3700522fa12b2
rhel-coreos sha256:055596f61ca59b6996b630f3d297c3ed48bd367271f8b443e4a74611ac6e39a9
rhel-coreos-extensions sha256:7e1a66cbeb9359217de73859ed426aa46daaac2b7b9b6e32a1bff67af61758ee
sdn git 1f611c53 sha256:c75f5d7eacb5f8e3f5fd818775e5babb49275cf599ac1dc1760e496136d319fa
service-ca-operator git 3c3f82f7 sha256:8d5dccef10a89381d636c4ddbee60fcc74cc7508f19ef88a17df1e3e7e52bd41
telemeter git 1f726816 sha256:239679e3a76b936cc7bc1b548ddc44f6be019fc6a61d2679e5deb4a04e25bf0d
tools git 44b3ac26 sha256:275647e58a63f60dcb8326756256db82f5e343b3e0287321924ef0daa8b0538e

agent-installer-api-server

MGMT-23439: Bump Go 1.18 to 1.20 and regenerate code #10042
OCPBUGS-78112: [release-4.14] NO-JIRA: hermetic 4.14 #9955
MGMT-23439: Use archived dnf repositories for CentOS Stream 8 #10018
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-58642: CVE-2024-45339: Bump glog pkg version to 1.2.4 (#1194) #1194
Full changelog

agent-installer-node-agent

OCPBUGS-102504: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1614
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102505: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #64
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123714: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #647
OCPBUGS-78229: [release-4.14] hermetic 4.14 #593
OCPBUGS-61944: UPSTREAM <carry>: revert: Only tag NetworkInterfaces in RunInstances if IAM Allows It #574
OCPBUGS-58667, OCPBUGS-58672: bump github.com/golang/glog to v1.2.5 #563
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102508: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #316
OCPBUGS-67748: Updated logrus to v1.9.3 #313
Full changelog

aws-machine-controllers

OCPBUGS-63142: client: re-use a single file for building the session instead of randomly named files #154
OCPBUGS-63142: revert: client: re-use a single file for building the session instead of randomly named files #151
OCPBUGS-63142: client: re-use a single file for building the session instead of randomly named files #142
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79820, OCPBUGS-79821: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #192
Full changelog

azure-cluster-api-controllers

OCPBUGS-78178: [release-4.14] Hermetic 4.14 #366
Full changelog

azure-file-csi-driver

OCPBUGS-79822: Correct grpc-go patch version #169
OCPBUGS-79822: Patching openshift-sustaining/grpc-go@v1.67.3-sec.1 #150
Full changelog

azure-file-csi-driver-operator

OCPBUGS-67753: Bump github.com/sirupsen/logrus to v1.9.3 #114
Full changelog

baremetal-installer, installer, installer-artifacts

OCPBUGS-79654: Azure UPI ARM template: use storageAccountId #10435
OCPBUGS-76930: terraform/provider/google: Fixing inconsistencies with service account creation #10324
OCPBUGS-62601: update resolv.conf every time on bootstrap node #9985
OCPBUGS-62814: Release 4.14 bump terraform provider azurerm #10001
Full changelog

baremetal-machine-controllers

OCPBUGS-78101: [release-4.14] fix vendor/ for hermetic migration #245
Full changelog

cloud-credential-operator

OCPBUGS-60975: ccoctl: aws to use proper issuer url on subsequent runs #911
OCPBUGS-58677: github.com/golang/glog v1.2.5 #895
Full changelog

cluster-autoscaler-operator

OCPBUGS-102528: Bump x/net package in release-4.14 #392
Full changelog

cluster-baremetal-operator

OCPBUGS-77449: Bump github.com/go-errors/errors to v1.5.1 #564
Full changelog

cluster-capi-controllers

OCPBUGS-77974: [release-4.14] fix vendor for hermetic #265
Full changelog

cluster-capi-operator

NO-JIRA: Allow sustaining engineering to self serve dependency updates #562
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-63170: ccm: disable unused secure-serving port and webhook #425
Full changelog

cluster-etcd-operator

OCPBUGS-67770: Update logrus to 1.9.3 to address CVE-2025-65637 #1548
Full changelog

cluster-image-registry-operator

OCPBUGS-67771: Bump logrus to 1.9.1 #1290
OCPBUGS-53867: Bump github.com/golang-jwt/jwt #1229
Full changelog

cluster-ingress-operator

OCPBUGS-86711: Add configuration override for X-SSL strip #1492
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-67775: CVE-2025-65637 openshift4/ose-cluster-kube-apiserver-operator: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload [openshift-4.14.z] #2045
Full changelog

cluster-kube-scheduler-operator

CNTRLPLANE-2843: chore: update OWNERS #626
Full changelog

cluster-kube-storage-version-migrator-operator

OCPBUGS-67780: Bump github.com/sirupsen/logrus to v1.9.1 #141
Full changelog

cluster-monitoring-operator

OCPBUGS-76415: test: remove image registry e2e tests #2811
Full changelog

cluster-network-operator

OCPBUGS-113758: Manual feature backport of cert rotation for whereabouts #3139
OCPBUGS-84184: fix(hypershift): use net.JoinHostPort for URL construction #2996
OCPBUGS-78105: fix vendor for hermetic 4.14 #2913
Full changelog

cluster-olm-operator

OCPBUGS-86344: Update grpc-go to v1.64.1-sec.1 to fix CVE-2026-33186 #209
Full changelog

cluster-openshift-apiserver-operator

OCPBUGS-76593: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #658
Full changelog

cluster-samples-operator

OCPBUGS-63518: references to github.com/sclorg/django-ex.git now also refer to the branch #661
Full changelog

cluster-storage-operator

OCPBUGS-87736: remove oVirt code from CSO 4.14 #711
OCPBUGS-67795: Bump logrus to v1.9.3 #655
Full changelog

console

OCPBUGS-98416: CVE-2026-59869 #16754
OCPBUGS-92716: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.14.z] #16963
OCPBUGS-105794: Fix and re-enable operator-install-single-namespace e2e test #17170
Fix for OCPBUGS-92074: CVE-2026-44990 #16721
OCPBUGS-100511: Bump postcss to fix CVE-2026-45623 #17109
OCPBUGS-105791: Disable failing OLM and pipelines e2e tests to unblock CI #16956
OCPBUGS-90614: Fix JSON annotation parsing to prevent OperatorHub crash #16659
OCPBUGS-87989: [release-4.14] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16597
OCPBUGS-77116: [release-4.14] CVE-2026-26996 Bump minimatch library #16348
Fix for OCPBUGS-81595: CVE-2026-4800 #16568
OCPBUGS-88422: Bump axios to ^0.33.0 Addresses CVE-2026-44486 #16789
OCPBUGS-79434: CVE-2026-29063 Bump immutable #16329
ART-18713: pin fsevents to latest #16473
NO-JIRA: enable multi-architecture yarn builds #16424
OCPBUGS-83297: [release-4.14] openshift4/ose-console: Axios: Remote Code Execution via Prototype Pollution escalation #16311
NO-JIRA: Updating openshift-enterprise-console-container image to be consistent with ART for 4.14 #16168
CONSOLE-5011: migrate to yarn berry #16082
NO-JIRA: Bump builder image to v29 #15991
OCPBUGS-74439: Bump lodash to latest #15971
OCPBUGS-44158: bump dompurify to latest #15593
OCPBUGS-59998: Remove the devconsole backend common internet proxy and replace it with dedicated ones #15464
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

console-operator

OCPBUGS-77994: [release-4.14] hermetic 4.14 #1131
OCPBUGS-77994: [release-4.14] NO-JIRA: update go mod dependency for konflux #1117
Full changelog

container-networking-plugins

OCPBUGS-78286: fix vendor for hermetic 4.14 #225
Full changelog

coredns

OCPBUGS-58713: [release-4.14] Bump github.com/golang/glog to v1.2.4 #139
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-79847: Apply code mitigations for CVE-2026-33186 #399
OCPBUGS-67800: fix CVE-2025-65637 #363
Full changelog

csi-driver-manila-operator

OCPBUGS-67801: Bump logrus #253
Full changelog

csi-driver-nfs

OCPBUGS-84929: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 to avoid go version bump and fix CVE-2026-33186 #184
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102559: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #531
Full changelog

docker-builder

OCPBUGS-66112: BuildConfig inline Dockerfile fails with heredoc syntax #492
Full changelog

gcp-cluster-api-controllers

OCPBUGS-78282: [release-4.14] update go mod dependency for konflux #269
Full changelog

gcp-machine-controllers

OCPBUGS-102607: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #194
OCPBUGS-79841: Bump google.golang.org/grpc to v1.79.3 #168
OCPBUGS-79841: Fix setup-envtest GCS 401 by downloading binaries directly #178
Full changelog

haproxy-router

OCPBUGS-86711: Strip X-SSL-* headers for plain HTTP #807
OCPBUGS-74947: Adding escapeHAProxySingleQuotes for sanitize [release-4.14] #782
OCPBUGS-86966: Regenerate expired test certificate for unit tests #781
Full changelog

hyperkube, pod

OCPBUGS-59473: UPSTREAM: 130047: adjusting loopback certificate validity in kube-apiserver #2364
OCPBUGS-67736, OCPBUGS-67822: CVE-2025-65637 - bump github.com/sirupsen/logrus to v1.9.3 [4.14] #2586
NO-JIRA: fix verify job failure #2584
OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #2570
OCPBUGS-59473: UPSTREAM: <carry>: disable some legacy cloud provider Azure tests #2579
Full changelog

hypershift

[release 4.14] Fix OCPBUGS-99086: CVE-2026-16242 konnectivity agent auth #9131
CNTRLPLANE-3979: Update release-4.14 Konflux pipelines to use shared pipelineRef #9196
OCPBUGS-84184: fix(cno): use brackets only for IPv6 in server URL #8370
OCPBUGS-61176: Add missing service network DNS entries to KAS cert #6742
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79836: Bump google.golang.org/grpc to v1.79.3 #156
OCPBUGS-77212: [release-4.14] standardize build paths #126
OCPBUGS-58738: bump github.com/golang/glog to v1.2.4 #109
OCPBUGS-56065: tech debt: rework vendor patches #93
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-67825, OCPBUGS-67826: bump github.com/sirupsen/logrus to v1.9.3 #166
OCPBUGS-59791: [IBM VPC] set offlineExpansion to false in e2e test manifest #151
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-102599: Bump golang.org/x/net to v0.35.0-sec.4 #63
OCPBUGS-56065: tech debt: rework vendor patches #50
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102592: Replace golang.org/x/net with openshift-sustaining/net #168
OCPBUGS-115546: Fetch envtest assets from the controller-tools releases #179
OCPBUGS-67290: [release-4.14] Fix incomplete vendor/ #136
OCPBUGS-51816: CVE-2025-22869 Update golang.org/x/crypto to patched OpenShift fork #123
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102612: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #108
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #111
Full changelog

ironic

OCPBUGS-97989: bump openstack-ironic pin for CVE-2026-44918 fix #920
OCPBUGS-97806: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.14) #879
OCPBUGS-69788: Bump eventlet version to 0.33.1-7 #765
Full changelog

ironic-agent

OCPBUGS-99891: Bump ironic-python-agent pinned commit for CVE-2026-66138 #312
OCPBUGS-96901: Replace individual package removal with a single rpm -e loop #278
OCPBUGS-69779: Bump eventlet version to 0.33.1-7 #234
Full changelog

ironic-machine-os-downloader

OCPBUGS-87171: CI image build root tag and go version in go.mod sync with ART 4.14 config #120
Full changelog

kube-storage-version-migrator

NO-JIRA: Add DOWNSTREAM_OWNERS (release 4-14). #229
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-95080: OWNERS: Update component to Cloud Compute / KubeVirt Provider #81
Full changelog

kubevirt-csi-driver

OCPBUGS-83659: Bump google.golang.org/grpc to v1.79.3 #104
Full changelog

machine-os-images

OCPBUGS-87880: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #104
Full changelog

monitoring-plugin

NO-JIRA: [release-4.14] Sanitize alert runbook URLs #1294
OCPBUGS-74442: [release-4.14] fix: upgrade lodash to remove vulnerable code #906
OCPBUGS-78495: fix for CVE-2025-69873 #851
Full changelog

multus-admission-controller

OCPBUGS-58763: Bump github.com/golang/glog to v1.2.4 #105
Full changelog

multus-cni

OCPBUGS-85381: Sanitize bracketed hostnames in kubeconfig server URLs #295
Bump Go to 1.21 and fix CI build root image #293
OCPBUGS-85253: Fix server url in kubeconfig #287
Full changelog

network-metrics-daemon

OCPBUGS-58778: Bump github.com/golang/glog to v1.2.4 (#115) #115
OCPBUGS-60394: Replace e2e test image (#128) #128
swtich golint install method (#127) #127
Full changelog

oauth-apiserver

OCPBUGS-74926: bump kubernetes-apiserver to pick up loopback cert expiration update #174
NO-JIRA: (chore): update OWNERS #176
Full changelog

openshift-apiserver

OCPBUGS-82649: Address CVE-2026-35469 #659
OCPBUGS-74924: bump kubernetes-apiserver to pick up loopback cert expiration update #602
OCPBUGS-76483: CVE-2025-65637 - Bump github.com/sirupsen/logrus from v1.9.0 to v1.9.3 [release-4.14] #612
OCPBUGS-56613: Fix image reference in TestImageStreamImportQuayIO #518
Full changelog

openshift-state-metrics

OCPBUGS-102633: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8:Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.14.z] #136
Full changelog

openstack-cinder-csi-driver-operator

OCPBUGS-67853: Bump logrus #189
Full changelog

openstack-machine-api-provider

OCPBUGS-78172: hermetic 4.14 #165
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102630: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1373
OCPBUGS-87896, OCPBUGS-87899: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #1326
OCPBUGS-86253: Drop github.com/distribution/distribution dep #1304
OCPBUGS-61469: [release-4.14] Add NetworkPolicy as a supported kind #1052
OCPBUGS-61390: [4.14] e2e stability fixes #1085
Full changelog

operator-marketplace

OCPBUGS-62222: Remove Expect func so that the test case can use the retry logic #673
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-97816: External gateway: Remove routes for external gateway pods in terminating or not ready state #3286
CORENET-6055, OCPBUGS-78982: [release-4.14] Dockerfile: Unpin OVN and consume the latest from FDP #3073
OCPBUGS-59872: Dockerfile: Remove ovs version pinning #2695
Full changelog

powervs-block-csi-driver-operator

OCPBUGS-67860: Fix CVE-2025-65637 by bumping logrus to v1.9.1 #100
Full changelog

powervs-machine-controllers

OCPBUGS-78039: hermetic 4.14 #136
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #405
Full changelog

prometheus

OCPBUGS-88588: remote: validate snappy decoded length before allocation in read endpoint #353
OCPBUGS-86878: Fix the inconsistent vendor directory #336
OCPBUGS-86878: Bump google.golang.org/grpc #323
Full changelog

prometheus-alertmanager

OCPBUGS-100361: Set testdata CA expiry to 20 years from issue date (#4112) #147
OCPBUGS-77837: Include go-verify-deps expected files in gitignore #121
Full changelog

prometheus-node-exporter

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #204
Full changelog

route-controller-manager

OCPBUGS-86883: [release-4.14] bump google.golang.org/grpc to v1.64.1-sec.1 #94
Full changelog

tests

OCPBUGS-74302: Skip E2e: attach on previously attached volumes should work #30727
OCPBUGS-63674: Fix regex parser #30391
OCPBUGS-61233: images/tests: Remove rteval #30208
Full changelog

thanos

OCPBUGS-67876: CVE-2025-65637 Update sirupsen/logrus to 1.9.3 #167
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-78031: hermetic migration 4.14 #109
Full changelog

vsphere-cluster-api-controllers

OCPBUGS-78023: hermetic migration 4.14 #88
OCPBUGS-61655: Fix unit tests #74
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-79856: Bump Bump google.golang.org/grpc #179
OCPBUGS-67880: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.8.3 #160
Full changelog

vsphere-csi-driver-operator

OCPBUGS-67879, OCPBUGS-67885: CVE-2025-65637: Bump github.com/sirupsen/logrus to v1.9.3 #325
Full changelog

vsphere-problem-detector

OCPBUGS-102657: Bump golang.org/x/net to v0.35.0-sec.4 #237
OCPBUGS-67891: bump github.com/sirupsen/logrus to v1.9.3 #202
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github