4.14.0-0.ci-2026-10-12-203253

Download the installer for your operating system or run

oc adm release extract --tools quay-proxy.ci.openshift.org/openshift/ci:rc_payload__4.14.0-0.ci-2026-10-12-203253

Qualifiers (status api): None

Tests:

Blocking jobs
- aws-ovn-upgrade-4.14-minor Succeeded periodic-ci-openshift-release-main-ci-4.14-upgrade-from-stable-4.13-e2e-aws-ovn-upgrade
- aws-sdn-serial Succeeded periodic-ci-openshift-release-main-ci-4.14-e2e-aws-sdn-serial
- azure-sdn-upgrade-4.14-minor Pending (1 retry) periodic-ci-openshift-release-main-ci-4.14-upgrade-from-stable-4.13-e2e-azure-sdn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Pending
- gcp-ovn-upgrade-4.14-micro Succeeded periodic-ci-openshift-release-main-ci-4.14-e2e-gcp-ovn-upgrade
- hypershift-e2e Pending (1 retry) periodic-ci-openshift-hypershift-release-4.14-periodics-e2e-aws-ovn
  - Attempt 1 Failed
  - Attempt 2 Pending

Upgrades from:

4.14.0-0.ci-2026-07-08-022443 - F P S
4.13.72 (changes) - S F P

Loading changelog, this may take a while ...

Changes from 4.14.0-0.ci-2026-07-08-022443

Created: 2026-10-12 20:33:43 +0000 UTC

Image Digest: sha256:0ba9c132faed0e8ef9e6c7abf59f0f2e7c1ddd314134e7ba53628dfc0d3bfd94

Components

Kubernetes 1.27.16
Red Hat Enterprise Linux CoreOS upgraded from 414.92.202607031936-0 to 414.92.202610091316-0 (diff)

Rebuilt images without code change

baremetal-machine-controllers git 0c1c23f3 sha256:180d2bf0c6bcaf3cb427056180aada0733fd3aa01cf9de21e0ea0ab22c89c05a
cli git 44b3ac26 sha256:6e510260428d8fc6650512da21146288af92e1f241025a9d461c3a8e0166d72b
cli-artifacts git 44b3ac26 sha256:f8eff249b5fd3051e25ed6353072daa656fe3fe7da2e2f18bdf2fc137b1ec521
cluster-etcd-operator git 8892946e sha256:109f8b68646bf408b3899e04e3f05db8be7c02ae1fd6e94965592791b45b8648
cluster-image-registry-operator git c9f6afc6 sha256:e37660bb6028e8c342d1802e89cd8621c10768cdaf40518f4984cdb6c929e821
cluster-storage-operator git 133655e3 sha256:07e28b0c60ba4964b9cb4e9c705cbe8017f2080a5b7201cec39620ced5f58703
deployer git 44b3ac26 sha256:f1cab10c15bbf50cd2ec2f26a4f8bb9c7281ab2ff128bd0e71b0239ab475aaef
driver-toolkit git cafed17b sha256:a9979b71b616419d0134ae57e4c353b85c246a9c44455f223e38eefc026e5464
machine-config-operator git 00b2e0b1 sha256:f1e5d27dfb5af9ef2b9fbaee6ed47ad0d4e764aa6224b6a898329f497fa9dfbe
machine-os-content sha256:2aace391f83a0247801e22254f2429d882bc3f5d6ab9c20cdf135716843e6cc1
rhel-coreos sha256:d7adabdd9ceed1a34dc24a4fdc6e569e032df17767ae29aaad2aba6edfe00dba
rhel-coreos-extensions sha256:2eb99c9d62c010fb7a23e5d81d2a91b3bf1348f1efe2da34b92195e1fd4f3945
tests git d885e43f sha256:934f6c3c4b0a313adee529e21c8a7e99d3e218275ebbac762d85ed73c102b22e
tools git 44b3ac26 sha256:f0b4e91639116e3f6aa38aad03081f3ec60864ef0f39715008bcaba354ff7c3c
vsphere-csi-driver-operator git 6593723f sha256:89f4946fc3124dbe86ecae06e070a030a5a7d7188d1da3752ac23140502af06b

agent-installer-api-server

OCPBUGS-89787: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.4 #10821
Full changelog

agent-installer-node-agent

OCPBUGS-102504: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1614
Full changelog

alibaba-cloud-controller-manager

OCPBUGS-102505: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #64
Full changelog

aws-cluster-api-controllers

🌱 OCPBUGS-123714: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #647
Full changelog

aws-ebs-csi-driver-operator

OCPBUGS-102508: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #316
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-79820, OCPBUGS-79821: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.64.1-sec.1 [release-4.14] #192
Full changelog

azure-disk-csi-driver-operator

OCPBUGS-102495: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #131
Full changelog

azure-file-csi-driver

OCPBUGS-102494: Bump golang.org/x/net to v0.35.0-sec.4 #162
OCPBUGS-79822: Correct grpc-go patch version #169
OCPBUGS-79822: Patching openshift-sustaining/grpc-go@v1.67.3-sec.1 #150
Full changelog

azure-file-csi-driver-operator

OCPBUGS-102503: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #119
Full changelog

baremetal-operator

OCPBUGS-102514: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #521
Full changelog

cluster-autoscaler-operator

OCPBUGS-102528: Bump x/net package in release-4.14 #392
Full changelog

cluster-monitoring-operator

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #3106
Full changelog

cluster-network-operator

OCPBUGS-113758: Manual feature backport of cert rotation for whereabouts #3139
Full changelog

cluster-openshift-controller-manager-operator

OCPBUGS-102558: Use patched x/net fork v0.35.0-sec.4 #448
Full changelog

console

OCPBUGS-98416: CVE-2026-59869 #16754
OCPBUGS-92716: CVE-2026-46597 openshift4/ose-console: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.14.z] #16963
OCPBUGS-105794: Fix and re-enable operator-install-single-namespace e2e test #17170
Fix for OCPBUGS-92074: CVE-2026-44990 #16721
OCPBUGS-100511: Bump postcss to fix CVE-2026-45623 #17109
OCPBUGS-105791: Disable failing OLM and pipelines e2e tests to unblock CI #16956
OCPBUGS-90614: Fix JSON annotation parsing to prevent OperatorHub crash #16659
OCPBUGS-87989: [release-4.14] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16597
OCPBUGS-77116: [release-4.14] CVE-2026-26996 Bump minimatch library #16348
Fix for OCPBUGS-81595: CVE-2026-4800 #16568
OCPBUGS-88422: Bump axios to ^0.33.0 Addresses CVE-2026-44486 #16789
Full changelog

console-operator

OCPBUGS-102556: Use patched x/net fork v0.35.0-sec.4 #1233
Full changelog

csi-driver-shared-resource, csi-driver-shared-resource-webhook

OCPBUGS-102559: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #531
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-102570: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.3 #242
Full changelog

docker-builder

OCPBUGS-89417, OCPBUGS-89800, OCPBUGS-90234, OCPBUGS-92322, OCPBUGS-92552, OCPBUGS-92703: Bump golang.org/x/crypto to fix CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-46597 #545
Full changelog

gcp-machine-controllers

OCPBUGS-102607: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #194
Full changelog

haproxy-router

OCPBUGS-86711: Strip X-SSL-* headers for plain HTTP #807
Full changelog

hypershift

[release 4.14] Fix OCPBUGS-99086: CVE-2026-16242 konnectivity agent auth #9131
CNTRLPLANE-3979: Update release-4.14 Konflux pipelines to use shared pipelineRef #9196
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-79836: Bump google.golang.org/grpc to v1.79.3 #156
Full changelog

ibm-vpc-node-label-updater

OCPBUGS-102599: Bump golang.org/x/net to v0.35.0-sec.4 #63
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-102592: Replace golang.org/x/net with openshift-sustaining/net #168
OCPBUGS-115546: Fetch envtest assets from the controller-tools releases #179
Full changelog

ibmcloud-machine-controllers

OCPBUGS-102612: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #108
NO-JIRA: fix unit tests broken by deprecated kubebuilder-tools bucket #111
Full changelog

ironic

OCPBUGS-97989: bump openstack-ironic pin for CVE-2026-44918 fix #920
OCPBUGS-97806: bump openstack-ironic pin for CVE-2026-54423 fix(release-4.14) #879
Full changelog

ironic-agent

OCPBUGS-99891: Bump ironic-python-agent pinned commit for CVE-2026-66138 #312
Full changelog

ironic-machine-os-downloader

OCPBUGS-87171: CI image build root tag and go version in go.mod sync with ART 4.14 config #120
Full changelog

kube-state-metrics

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #178
Full changelog

kubevirt-csi-driver

OCPBUGS-83659: Bump google.golang.org/grpc to v1.79.3 #104
Full changelog

monitoring-plugin

NO-JIRA: [release-4.14] Sanitize alert runbook URLs #1294
Full changelog

oc-mirror

OCPBUGS-129616: v1 accept catalog root entries and relative symlink targets #1582
Full changelog

openshift-apiserver

OCPBUGS-82649: Address CVE-2026-35469 #659
Full changelog

openshift-state-metrics

OCPBUGS-102633: CVE-2026-33814 openshift4/ose-openshift-state-metrics-rhel8:Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.14.z] #136
Full changelog

operator-lifecycle-manager, operator-registry

OCPBUGS-102630: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 to address CVE-2026-33814 #1373
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-97816: External gateway: Remove routes for external gateway pods in terminating or not ready state #3286
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #405
Full changelog

prometheus

OCPBUGS-102651: Use patched x/net fork v0.35.0-sec.4 #376
NO-ISSUE: synchronize OWNERS from main branch #390
OCPBUGS-88588: remote: validate snappy decoded length before allocation in read endpoint #353
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #200
OCPBUGS-100361: Set testdata CA expiry to 20 years from issue date (#4112) #147
Full changelog

prometheus-node-exporter

OCPBUGS-102636: Use patched x/net fork v0.35.0-sec.4 #192
NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #204
Full changelog

route-controller-manager

OCPBUGS-86883: [release-4.14] bump google.golang.org/grpc to v1.64.1-sec.1 #94
Full changelog

telemeter

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #625
Full changelog

thanos

NO-ISSUE: synchronize OWNERS from main branch [release-4.14] #219
Full changelog

vsphere-problem-detector

OCPBUGS-102657: Bump golang.org/x/net to v0.35.0-sec.4 #237
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github