4.18.60

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.18.60-x86_64

Qualifiers (status api): None

Tests:

Blocking jobs
- upgrade Succeeded (1 retry) periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.18-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.18-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- aws-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.18-micro Succeeded (1 retry) periodic-ci-openshift-release-main-ci-4.18-e2e-azure-ovn-upgrade
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.18-fips-payload-scan
- gcp-ovn-rt-upgrade-4.18-minor Succeeded periodic-ci-openshift-release-main-ci-4.18-upgrade-from-stable-4.17-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.18 Failed (1 retry) periodic-ci-openshift-hypershift-release-4.18-periodics-e2e-aws-ovn-conformance
  - Attempt 1 Failed
  - Attempt 2 Failed
- metal-ipi-ovn-ipv4 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv4
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.30, 4.17.31, 4.17.32, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.48, 4.17.49, 4.17.50, 4.17.51, 4.17.52, 4.17.53, 4.17.54, 4.17.55, 4.17.56, 4.18.10, 4.18.11, 4.18.12, 4.18.13, 4.18.14, 4.18.15, 4.18.16, 4.18.17, 4.18.18, 4.18.19, 4.18.20, 4.18.21, 4.18.22, 4.18.23, 4.18.24, 4.18.25, 4.18.26, 4.18.27, 4.18.28, 4.18.29, 4.18.30, 4.18.31, 4.18.32, 4.18.33, 4.18.34, 4.18.35, 4.18.36, 4.18.38, 4.18.39, 4.18.4, 4.18.40, 4.18.41, 4.18.43, 4.18.44, 4.18.45, 4.18.46, 4.18.47, 4.18.49, 4.18.5, 4.18.50, 4.18.51, 4.18.52, 4.18.53, 4.18.54, 4.18.55, 4.18.56, 4.18.6, 4.18.7, 4.18.8, 4.18.9

Upgrades to:

4.19.0-0.ci-2026-11-05-142220 (changes) - Pending

Loading changelog, this may take a while ...

Changes from 4.18.48

Created: 2026-11-05 05:35:29 +0000 UTC

Image Digest: sha256:d0253567dd0d96590d441b63c50cc410eb1ca8bd997116d4dc6717efa6527cdd

Components

Kubectl 1.31.1
Kubernetes 1.31.14
Kubernetes Tests 1.31.12
Red Hat Enterprise Linux CoreOS upgraded from 418.94.202607020219-0 to 418.94.202611030931-0 (diff)

Rebuilt images without code change

agent-installer-utils git 63b87f06 sha256:0a554420bf16a91a58de520f11a7d230b1778e641bb97c239db6779f9c1febed
apiserver-network-proxy git 2f62712d sha256:eacd26fad46427dedf2a8049cc73a1cc358f05ee5d025023b0fe0182b3757f75
aws-cloud-controller-manager git c3951906 sha256:177966042b2df9ad720e729b39e778ea9f695d73992cb47a4573c945c324fa2f
aws-ebs-csi-driver git 96ae9d03 sha256:45d09d8efeba3905ccb23df64844c66e4100244a2c303f2a06610e454ffea9a1
aws-kms-encryption-provider git 075d56fd sha256:167ab3fca65dfc163c578b81ef7b9f07fe272c8209a278a89a54fa6f92310053
aws-machine-controllers git 7b6bfc74 sha256:1af8a0148124e8ffdb2804696718cec28ce5578276638a8ad3b7a9d536dd683e
aws-pod-identity-webhook git f54f9a19 sha256:91fd48ce4d51acc146ae997ad499e4d74cecdf2136c87b0b654b3b0a8d7665ef
baremetal-cluster-api-controllers git 80c3a063 sha256:37eb4a361b8fe1d7d68ce1f235c61606591c6015792a8e6ece022d1cee2f1d89
baremetal-machine-controllers git 1ede6c3f sha256:dae1a0c07347a992f7c83eeb4eda48017c6a6059d23c3894b2cd8607a3fead9f
cloud-network-config-controller git f892b915 sha256:546eaf1c0bed1808e5edc5b2f2bdeb329711e2f6a071b3b71a0cae3e9504418f
cluster-autoscaler git 34730793 sha256:fd8753a447ab1e7baca81724bb5ef2581b4972d0b5fc007ac4635547952f48af
cluster-baremetal-operator git 3e6d1ab1 sha256:227e908993d76d68bb9df46b06e5c21d285c170d5bf2fb041985112126d5fd4d
cluster-bootstrap git d1e01954 sha256:4fdc4a82c7a55d85f989e63937c59a33d767e3209f6ed3d882b2a14090b64604
cluster-capi-controllers git c4c8799b sha256:af669dc1c7ea197bef96975dfbdb50f9c2f13c832ab0f8adfe678ed960cb317f
cluster-capi-operator git b5b89440 sha256:073ffc76993a1b6e84cf8b473adafc6a2c4ac3d1d961aef7c720a51c15b21450
cluster-config-operator git fe5e9286 sha256:3c3b53f201fa29f9463fb04d785f9bb7051e70d37310e48027d24c871bb7609d
cluster-control-plane-machine-set-operator git d17bf3a1 sha256:bf2609e9f1d12c7b5dd96799bb5bdc93bb4c5b1467e2c61d93c5ec8fd59f884a
cluster-image-registry-operator git 1e3caa4b sha256:191ab0e5a7993d29e7e9fd8b801d13bac44809cc94a70af4a0029c0f906b1e72
cluster-kube-cluster-api-operator git efe651a9 sha256:cf39ee7495fd7ce002f6efe5c43a4476723211f1d8d429a9101732bb6f836183
cluster-kube-storage-version-migrator-operator git 59ba356f sha256:d5ce4fb9ddf85324aa0aae664700e363e465aeb3442c7c1911b1f2df9f34e6cb
cluster-machine-approver git 01d5fbbe sha256:07c4407b8cd091721e488de2505151f376694e2922dd278b4f759d9dcb73e392
cluster-olm-operator git fa9d9ab4 sha256:eff95ef6120c83a2350a08d1868172a68f88038cb85c5f652ba34466ea45f08b
cluster-openshift-apiserver-operator git 0a6f6eb9 sha256:a8390df6931dae6ae0ab651b360ed2c7e7743e22bb1bc2e6a3aedc0aec18ea72
cluster-openshift-controller-manager-operator git f1711cf3 sha256:6f13a185385ca7c318fd88df97cd4579b2dd519e22cf8a57d590d4ff347591b5
cluster-update-keys git 8caab452 sha256:6844deccbf3156bf1a71fe597103dd43477b497721362fd8f8685ded1bd87df8
configmap-reloader git e2aaf00a sha256:2847361b634b9e7db7dd7808f13e67af4860af54002da9212bed84c80dc2d8c6
container-networking-plugins git 090b88ce sha256:900bc582f49ec28f88acdfc32f2c79a61ff599834559dfafdcacbdc487bfd466
containernetworking-plugins-microshift git 090b88ce sha256:83d0a201cd3b923c12a750a2aa11f5a1cc91433e360435b1d818e287a5bb0049
csi-node-driver-registrar git ef93f0be sha256:3bf1e8c4feabc6d0fda241802f01050afe948322750675d9acedca29554ea68f
driver-toolkit git 2e139edc sha256:3d083dee6d7e07d466d2a86acc14567bf7cdbde6a78c357306bc471e42753825
etcd git b5a4f8d0 sha256:3fd5814e01a661e4235482db7199fd67b01c700c8f9da554cdcd63657be04c1a
gcp-cloud-controller-manager git 6ea23561 sha256:381e62e05672409fc38414aecad33fc51f1562c3fb3399de592e60c466bb6552
gcp-cluster-api-controllers git 6d453944 sha256:525853b7045f31b9cfe57d8600445c7dd9fed897debfcb73060f4aa414611621
gcp-pd-csi-driver-operator git 4432976a sha256:31676c1a5d7637df6e0b81691ad971a08487160699f9bea621e63f56d8a30257
ibm-vpc-block-csi-driver git 4f6a6d3b sha256:6d9650840e03f9957059b124a4d73679b3cd3215bc4eff52189df13de752ab6f
insights-runtime-exporter git 3d444833 sha256:2e9fdf56e9bfa37b980a91b6ae7b33a0a45ae5b6c0ddcf0104306281cce886b8
insights-runtime-extractor git 3d444833 sha256:a90711f5216e256c27a0023ea3d5d5dd3765712b942dad093a6fbff482c3c15f
ironic-machine-os-downloader git 50ca44fd sha256:a3d8786ea9d1b8344d10498d3725a330f92d2275ca9f8bc1be79176da0a976c5
ironic-static-ip-manager git cfbae04f sha256:7df378abcc5e0e27b94dec54f1aa6780dbf4c34bf820ecedcb6137ac57d28ce9
keepalived-ipfailover git 716eb0ef sha256:ab1f5a751baadac984c4d4d13b7edbedf3acbc682a32a5a64d69f56ecd7044d1
kube-storage-version-migrator git 815b43b7 sha256:85d9d03066f28f40a2e3bfed2d432bc09fb15b5d8a7ea5708e7e1c40415369f5
libvirt-machine-controllers git 875b03bd sha256:9d12d4ab58a87f529f943ad7adeb8708f436f31770ee6c82e6280b837bcbfb88
machine-os-images git b2321b2c sha256:b506cc21c0f679047463f86a5c190aacf22461938175461d1869020cf4fdf901
metallb-frr git 760c6639 sha256:08f462013020a13e57f014c54d0cf774641bf604d053ab7d17efdbf5d593a780
multus-route-override-cni git 391c1b03 sha256:c2fa4ace580986852f6dc92bd1d194e6a749d62191475be7e3b861a099e73d3f
multus-whereabouts-ipam-cni git 86191ded sha256:c2efae8d9edc3d7720787b81cda9f04bdf098f098786aaa3d91e4c09db3df451
must-gather git bfba924c sha256:bb719475a2c45af9a1857926926256d09a2151d85cd01bbfb347d17836284c28
network-interface-bond-cni git e2de9255 sha256:9a3992359db920131386e64b191ac9ab1a3b7e71b3416c9be470d7ae06fef479
network-tools git 47b13549 sha256:f7522ebe3f8f80c75cf2a3041c26dc678325af93d6574bb2a2d7ce3ab59af72d
nutanix-machine-controllers git afe324bf sha256:c501b7146cd62ab46d91c435f7629e972bea09f84c63042d5262db1ff028deeb
olm-catalogd git 180aa92c sha256:2f99f5d53ff8dd8d7e63709667b1587a09ecba436c71dc2c62a4d1e3d9f79507
openshift-apiserver git 0185e4bf sha256:0a68e7a4e5c70b092b99e584a994b236c2e729908f0081a57ad84deca4c52785
openstack-cluster-api-controllers git d5e6ff9f sha256:7a40db26292851a3a426b2c3eb92f953ed921191843c4d32ed56b0bad4e83e54
operator-marketplace git 34521c26 sha256:18b179692f4c1d3a5b77ff4ade13c1fe824906bcfd2386434409dd9698359612
powervs-block-csi-driver git e8700dfa sha256:a563cf328d85c9d82b13cd6e015a41d3f7682cf6c0d3dded0f4b3cb102bac5e7
powervs-block-csi-driver-operator git 9c9131b7 sha256:a47e5bd6f21980d7aaccd9fde460d3ced339574ef18eb348835c5a9444bb0b41
powervs-cloud-controller-manager git 601c30ff sha256:aa8b0767e2c40ec4980006c829a51c614ea61210de63959ac287c94f66409818
powervs-machine-controllers git 74e3ece7 sha256:7577bed5ff482e8df14ea8b0bc02bb98c077768c91b7cd19c539f24d2612c4c1
rhel-coreos sha256:63da6a5aea88f89765030e691345ddea3d85442178766cc61cffd37d3ddc3e1f
rhel-coreos-extensions sha256:ad3a45c10fb1a52706e0fde3ea8c892c350c08f4f8fce471a4d7a12bd595fd94
service-ca-operator git 30efb529 sha256:1d3afef5cb5ad00189db25df6eeed88b93da8c758260c8d221402c2e9b2a1a94
telemeter git 999cdb5f sha256:17f4a5dad8c1c3ec5ae68a0c76224f083c64e0edfc8856718a1441bddb1c8b0d
thanos git 265d24eb sha256:f3ea5b6a3929672fd16285c026b44860127a9b24c05640801e4b6eb1d8787d24
vsphere-cluster-api-controllers git afae9545 sha256:c54dcb4a52a91f6476baf318d33d1b375d3b2973c4e51bb3d0e34a87d4a4fc50

agent-installer-api-server

OCPBUGS-89884: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10800
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103348: Bump x/net to v0.35.0-sec.4 #2297
Full changelog

agent-installer-node-agent

OCPBUGS-103362: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #1618
Full changelog

aws-cluster-api-controllers

🐛 OCPBUGS-134667: UPSTREAM: 6132: Persist ProviderID immediately after instance creation #668
OCPBUGS-103372: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #652
🐛 OCPBUGS-123705: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment #642
🌱 OCPBUGS-123680: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #641
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-103431, OCPBUGS-103496, OCPBUGS-103518: Use patched x/net fork v0.35.0-sec.4 #632
OCPBUGS-103360, OCPBUGS-103371: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #610
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-103373, OCPBUGS-103550: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #208
Full changelog

azure-cluster-api-controllers

OCPBUGS-89899: Address CVE-2026-39829 #401
Full changelog

azure-disk-csi-driver

UPSTREAM: 3635: OCPBUGS-103367: Bump golang.org/x/net to v0.43.0-sec.4 #172
OCPBUGS-114621: UPSTREAM: 3277: fix: allow . in Azure tags #179
Full changelog

azure-file-csi-driver

OCPBUGS-103366: Bump golang.org/x/net to v0.35.0-sec.4 #158
OCPBUGS-92789: Bump golang.org/x/crypto to v0.33.0-sec.3 #148
Full changelog

azure-kms-encryption-provider

OCPBUGS-80185: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #46
Full changelog

azure-machine-controllers

OCPBUGS-103471: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #213
Full changelog

azure-workload-identity-webhook

OCPBUGS-103390: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #63
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-134631: Update RHCOS-release-4.18 bootimage metadata to 418.94.202610242013-0 #11036
NO-JIRA: data/manifests/bootkube/cvo-overrides: Default to eus-4.18 #11004
OCPBUGS-103391, OCPBUGS-103464: Bump golang.org/x/net to v0.35.0-sec.4 #10970
OCPBUGS-89882, OCPBUGS-89888, OCPBUGS-89919, OCPBUGS-92878: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.4 #10901
OCPBUGS-121872: Update gcloud version to one that can be found #10857
OCPBUGS-77052: Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 #10795
Full changelog

baremetal-operator

OCPBUGS-98321: Add BMH finalizer on PreprovisioningImage #509
OCPBUGS-59259: Fix HFC error handling in actionPreparing #502
Full changelog

baremetal-runtimecfg

OCPBUGS-103376: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #408
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-78501: Makefile: Strip debugging symbols by default #2227
OCPBUGS-103346, OCPBUGS-103383: Use patched x/net fork v0.35.0-sec.4 #2418
OCPBUGS-91365, OCPBUGS-94688: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2344
OCPBUGS-109669: Fix pre-existing unit test failures on release-4.18 #2372
Full changelog

cloud-credential-operator

OCPBUGS-103387: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1100
OCPBUGS-81887: Bump go-jose/go-jose/v4@v4.1.4 #1031
OCPBUGS-80219: Fix CVE-2026-33186 using openshift-sustaining grpc-go fork #1041
Full changelog

cluster-authentication-operator

OCPBUGS-103378: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #988
Full changelog

cluster-autoscaler-operator

OCPBUGS-103386: Bump x/net package in release-4.18 #388
Full changelog

cluster-cloud-controller-manager-operator

OCPBUGS-103380: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #513
Full changelog

cluster-config-api

OCPBUGS-98486: add new serviceAccountToken fs type #2927
Full changelog

cluster-csi-snapshot-controller-operator

OCPBUGS-103405: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #293
Full changelog

cluster-dns-operator

OCPBUGS-103403: Use patched x/net fork v0.35.0-sec.4 #495
Full changelog

cluster-etcd-operator

OCPBUGS-103410: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #1695
Full changelog

cluster-ingress-operator

OCPBUGS-103414: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1571
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-apiserver-operator

OCPBUGS-103402: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #2299
Full changelog

cluster-kube-controller-manager-operator

OCPBUGS-103404: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #961
Full changelog

cluster-kube-scheduler-operator

OCPBUGS-103397: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #669
Full changelog

cluster-monitoring-operator

OCPBUGS-129140: don’t delete admin-owned Alertmanager secrets on destroy #3142
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #3116
OCPBUGS-103412: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3075
OCPBUGS-105311: [release-4.18] wrap library-go resourceCache with mutex for thread safety #3041
OCPBUGS-104540: Backport e2e stabilization 4.18 #3030
OCPBUGS-100375: [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly #3024
OCPBUGS-94081: ship collector:node_scrape_collector_success:avg to Telemetry #2992
Full changelog

cluster-network-operator

OCPBUGS-100191: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3096
Full changelog

cluster-node-tuning-operator

OCPBUGS-69395: E2E add test to verify guaranteed pod is running after kubelet restart #1448
OCPBUGS-90575: Requeue PerformanceStatus update when status write fails #1552
Full changelog

cluster-policy-controller

OCPBUGS-98486: Backport fs type service account token 4.18 #196
Full changelog

cluster-samples-operator

OCPBUGS-133349: Restrict samples operator access to the global pull-secret- #731 #731
Full changelog

cluster-storage-operator

OCPBUGS-103401: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #735
Full changelog

cluster-version-operator

OCPBUGS-103432: Bump golang.org/x/net to v0.35.0-sec.3 #1459
Full changelog

console

OCPBUGS-127158: [release:4.18] linkify-it: Denial of Service via crafted mailto: links #17381
OCPBUGS-127183: Re-enable Knative Cypress e2e tests #16907
OCPBUGS-113759: block GraphQL introspection over websocket #17130
Fix for OCPBUGS-92075: CVE-2026-44990 #16717
OCPBUGS-100515, OCPBUGS-101791: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17058
OCPBUGS-98420: [release-4.18] CVE-2026-59869 bump js-yaml #17076
OCPBUGS-81520: Console can only show user name instead of full name as the display name #16238
OCPBUGS-86740, OCPBUGS-87085, OCPBUGS-97763: [release-4.18] bump package: protobufjs, fast-uri #16728
OCPBUGS-100069: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16872
OCPBUGS-91944: Prevent binary secret data corruption when editing #16673
OCPBUGS-99487: Disable Knative e2e Cypress tests in CI #16803
OCPBUGS-99648: Disable shipwright e2e tests to unblock CI #16818
OCPBUGS-86453: [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16511
Fix for OCPBUGS-81604: CVE-2026-4800 #16563
OCPBUGS-84284: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16675
Full changelog

console-operator

OCPBUGS-103424: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #1223
OCPBUGS-98985: [4.18] Stabilize telemetry config to prevent continuous console pod rollouts #1190
Full changelog

coredns

OCPBUGS-103421: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #205
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-103493, OCPBUGS-103494: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #422
Full changelog

csi-driver-nfs

OCPBUGS-82754: Bump github.com/moby/spdystream@v0.5.1 #194
Full changelog

csi-external-attacher

UPSTREAM: 110: OCPBUGS-103429: Bump golang.org/x/net to v0.35.0-sec.4 #115
Full changelog

csi-external-provisioner

OCPBUGS-92883: Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.33.0-sec.5 to address CVE-2026-46597 #163
Full changelog

csi-external-resizer

OCPBUGS-103430: Bump golang.org/x/net to v0.35.0-sec.4 #213
OCPBUGS-80257: Bump google.golang.org/grpc to v1.79.3 #203
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-127502: [release-4.18] OCPBUGS-127500: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion #257
OCPBUGS-103427, OCPBUGS-103428: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #228
Full changelog

csi-livenessprobe

OCPBUGS-103425: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #103
Full changelog

docker-builder

OCPBUGS-89907, OCPBUGS-90327, OCPBUGS-92414, OCPBUGS-92621, OCPBUGS-92892: Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 #549
Full changelog

docker-registry

OCPBUGS-103437: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #480
Full changelog

egress-router-cni

OCPBUGS-100191: Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 #109
Full changelog

gcp-machine-controllers

OCPBUGS-103482: Bump golang.org/x/net to v0.35.0-sec.3 #189
Full changelog

gcp-pd-csi-driver

OCPBUGS-103438: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #145
Full changelog

gcp-workload-identity-federation-webhook

OCPBUGS-103450: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 #26
Full changelog

haproxy-router

OCPBUGS-86726: Prevent SSRF via FQDN-typed EndpointSlices #821
OCPBUGS-86715: Strip X-SSL-* headers for plain HTTP #800
Full changelog

hyperkube, kube-proxy, pod

OCPBUGS-82737, OCPBUGS-82761: Address CVE-2026-35469 #2689
Full changelog

hypershift

ACM-45149: Migrate Go builder for hypershift-cli, hypershift-release #10068
OCPBUGS-131922: Router publish strategy related changes for IBM Cloud platform #10007
fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 #8289
ACM-37663: Rebase hypershift operator runtime image to RHEL 9.8 ELS #9451
ACM-38044: update Containerfile.cli base images to floating tags [release-4.18] #9044
OCPBUGS-99142: fix(backport): konnectivity agent auth #9096
OCPBUGS-62756: Restart HCP on stale serving certs #8245
Full changelog

ibm-cloud-controller-manager

OCPBUGS-120695: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #114
Full changelog

ibm-vpc-block-csi-driver-operator

OCPBUGS-103440: Use patched x/net fork v0.35.0-sec.4 #189
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103453: Replace golang.org/x/net with openshift-sustaining/net #172
OCPBUGS-115513: Fetch envtest assets from the controller-tools releases #183
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103467: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #104
OCPBUGS-41223: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 #45
NO-JIRA: vendor golint instead of relying on the CI build root #115
Full changelog

insights-operator

OCPBUGS-103459: Bump golang.org/x/net to v0.35.0-sec.3 #1355
Full changelog

ironic

OCPBUGS-88475: Updating openstack-ironic commit that fixes CVE-2026-43003 #903
OCPBUGS-105860: update ironic pin to include CVE-2026-54423 fix (release-4.18) #893
OCPBUGS-100164: Update openstack-ironic commit hash for CVE-2026-44918 #888
Full changelog

ironic-agent

OCPBUGS-99888: Correct ironic-python-agent pin to include the CVE-2026-66138 fix #314
OCPBUGS-88475: Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 #313
OCPBUGS-99888: Bump ironic-python-agent pinned commit for CVE-2026-66138 #308
Full changelog

kube-metrics-server

NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #81
Full changelog

kube-rbac-proxy

OCPBUGS-39450: Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 #105
Full changelog

kube-state-metrics

OCPBUGS-103452: Use patched x/net fork v0.35.0-sec.4 #164
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #172
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-39554: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 #45
Full changelog

kubevirt-csi-driver

OCPBUGS-80191: Bump google.golang.org/grpc to v1.79.3 #101
Full changelog

machine-api-operator

OCPBUGS-103469: replace golang.org/x/net with openshift-sustaining/net@v0.35.0-sec.4 #1545
Full changelog

machine-config-operator

OCPBUGS-103483: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #6507
OCPBUGS-129117: Degraded MCP as generated-kubelet is generated with an old controller version #6624
OCPBUGS-127017: Update message for MachineOSBuildFailed condition #6566
OCPBUGS-122250: Add missing verb in MCC RBAC #6540
OCPBUGS-105477: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6391
OCPBUGS-94116: move cleanUpDuplicatedMC to avoid double reboot on first updated #6249
OCPBUGS-91747: Verify extension packages are installed #6216
OCPBUGS-98445: Remove sensitive ControllerConfig logging #6294
Full changelog

machine-image-customization-controller

OCPBUGS-103463: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #193
Full changelog

monitoring-plugin

OU-1589: [release-4.18] sanitize linkified URLs in alert annotations #1378
NO-JIRA: [release-4.18] fix: reduce flakiness by assert charts existence and scroll into view before clicking #1365
OU-1241: [release-4.18] feat: unset query timeouts so they are defined in the backend #1359
OCPBUGS-103481: CVE-2026-33814-4-18 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.18] #1217
NO-JIRA: [release-4.18] Sanitize alert runbook URLs #1297
OCPBUGS-98772: [release-4.18] replace outdated react-linkify dependency #1179
OCPBUGS-74461: CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] #1141
Full changelog

multus-admission-controller

OCPBUGS-103470: bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 #134
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-103476, OCPBUGS-103477: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #357
Full changelog

multus-networkpolicy

OCPBUGS-103473: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #128
Full changelog

network-metrics-daemon

OCPBUGS-103472: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #153
OCPBUGS-130596: fix golint not found on Go 1.22 CI builder #156
Full changelog

networking-console-plugin

OCPNETUI-168: Update Owners file #647
OCPBUGS-98784: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #460
OCPBUGS-99991: Updating networking-console-plugin-container image to be consistent with ART for 4.18 #454
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

nutanix-cloud-controller-manager

OCPBUGS-103479: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 #77
Full changelog

oauth-apiserver

OCPBUGS-103486: Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 #224
Full changelog

oauth-proxy

OCPBUGS-112094: bugfix: rewrite open redirect strings to ‘/’ #384
Full changelog

oauth-server

OCPBUGS-103490: Replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 #281
OCPBUGS-87072: bugfix: default to english when Accept-Language header contains more than 1000 underscores #272
Full changelog

oc-mirror

OCPBUGS-129488: v1 accept catalog root entries and relative symlink targets #1578
Full changelog

olm-operator-controller

OCPBUGS-103488: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #804
OCPBUGS-100434: increase catalog HTTP client timeout from 10s to 5m #787
Full changelog

openshift-controller-manager

OCPBUGS-103487: Use patched x/net fork v0.35.0-sec.4 #457
Full changelog

openshift-state-metrics

NO-ISSUE: synchronize OWNERS from main branch #153
Full changelog

openstack-machine-api-provider

OCPBUGS-93867: Revendor CAPO #174
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103497, OCPBUGS-103502, OCPBUGS-103503: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1366
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-132721: Branch Sync release-4.20 to release-4.18 [10-16-2026] #3553
OCPBUGS-129152: Branch Sync release-4.20 to release-4.18 [10-05-2026] #3511
OCPBUGS-112810, OCPBUGS-113507: Branch Sync release-4.19 to release-4.18 [08-21-2026] #3410
OCPBUGS-105851: Branch Sync release-4.19 to release-4.18 [08-11-2026] #3386
OCPBUGS-82773: Bump github.com/moby/spdystream to v0.5.1 #3321
OCPBUGS-98957: Branch Sync release-4.19 to release-4.18 [07-09-2026] #3290
Full changelog

prom-label-proxy

NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #409
Full changelog

prometheus

NO-ISSUE: synchronize OWNERS from main branch #386
OCPBUGS-93696: fix for CVE-2026-42151 #368
OCPBUGS-88628: remote: validate snappy decoded length before allocation in read endpoint #346
Full changelog

prometheus-alertmanager

NO-JIRA: synchronize OWNERS with main #189
OCPBUGS-103512: Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 #172
OCPBUGS-98183: build(deps): hashicorp/memberlist to a forked version #165
OCPBUGS-100355: Set testdata CA expiry to 20 years from issue date (#4112) #148
Full changelog

prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook

NO-ISSUE: synchronize OWNERS from main branch #412
OCPBUGS-103510, OCPBUGS-103513: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #397
Full changelog

prometheus-node-exporter

OCPBUGS-103506: Use patched x/net fork v0.35.0-sec.4 #196
NO-ISSUE: synchronize OWNERS from main branch [release-4.18] #202
Full changelog

route-controller-manager

OCPBUGS-103349: Fix CVE-2026-33814 by adding patch for golang.org/x/net package #110
Full changelog

tests

OCPBUGS-130856: stage the creation of test pods to minimize etcd impact #31740
Full changelog

vsphere-cloud-controller-manager

OCPBUGS-103524: Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.18 #135
Full changelog

vsphere-csi-driver, vsphere-csi-driver-syncer

OCPBUGS-92888: Bump golang.org/x/crypto/ssh to v0.33.0-sec.3 #193
Full changelog

vsphere-csi-driver-operator

OCPBUGS-103531: Bump golang.org/x/net to v0.35.0-sec.3 #356
Full changelog

vsphere-problem-detector

OCPBUGS-129532: Fixed compute cluster permission logic for single fd with read-only custom resourcepool #245
OCPBUGS-103545: Bump golang.org/x/net to v0.35.0-sec.4 #233
Full changelog

View changelog in Markdown or change previous release:

Source code for this page located on github