# 4.20.26

Created: 2026-06-18 12:35:06 +0000 UTC

Image Digest: `sha256:5a2bec1f74236deb9519ab5232146c57d2afdb8f8db6773abbb50027150eb8ad`


## Changes from 4.20.25

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.12
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260608-0 to 9.6.20260616-0


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [b2712866](https://github.com/openshift/assisted-service/commit/b271286656c2186ea8940ea6463da523f00094f0) `sha256:b3a9fee448a212907122556f9d2b6441122cd09f03fd85b953db0f06527cd841`
* [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui) git [1f0fec5e](https://github.com/openshift-assisted/assisted-installer-ui/commit/1f0fec5ed74412d0f96e6a7239e9689b24563ebe) `sha256:fe589677a60e47f089add4a8662d7a5bb018d149bd40951450afcad9459d0868`
* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [e3e997d9](https://github.com/openshift/agent-installer-utils/commit/e3e997d9f7b84b134a07186de9bddde21598ae32) `sha256:06833bd27e40dd3a770cac2b4bc943cbbcc005409df8bcb8da465c2f4cfe25e3`
* [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver) git [c7bce6e9](https://github.com/openshift/azure-file-csi-driver/commit/c7bce6e96df8f14b61ead343b901087a44736513) `sha256:7b5d98fb5c01c84f70fdd05e5ca4ea35f580eacf123fd70744dd207e90ac8ecc`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [94d9ffd3](https://github.com/openshift/cluster-node-tuning-operator/commit/94d9ffd3ec8db4587884e13400bbc87d79c21da7) `sha256:fdea6c63c595dc8b02cef15286aeb3ddc3bfe0193de45201d0cfb11a3bcd589f`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [62e1f604](https://github.com/openshift/driver-toolkit/commit/62e1f6040cd297149f5f14e0d20814759ec61354) `sha256:3cb1ef218d08069307b9cb1013d1a3814567df8ec55f64ddd9b72f5790a03f3c`
* [ironic-agent](https://github.com/openshift/ironic-agent-image) git [652b8b4d](https://github.com/openshift/ironic-agent-image/commit/652b8b4dcffda86f61e181b43cda184292372a14) `sha256:7c254637daf1b7564394c9a6425b9dec8a711e27ccfc659d5a55471c218b14cd`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [6c92e542](https://github.com/openshift/ironic-rhcos-downloader/commit/6c92e5425b58baa9d4dd951a992b7460e8407247) `sha256:ad266469369890878063a4e0793c144bf73be0c963be65f154f3e8988c666fe2`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:86e58cc04993c9ebb62ff13f8c9e38fcb1dd1bbdd7f5474a8c6de3a73b628492`
* [networking-console-plugin](https://github.com/openshift/networking-console-plugin) git [c9c1a9f5](https://github.com/openshift/networking-console-plugin/commit/c9c1a9f5ca8287d20a0aafab9507478c6f291614) `sha256:8caabe7828c7c1df3b1edf2585a48055615ff16becb6149a8d558ce9ce717862`
* [rhel-coreos](https://github.com/openshift/os) git [ee943c37](https://github.com/openshift/os/commit/ee943c37e640fcc5812d4a2a20ac66d57984e79c) `sha256:ab26e9394879c90127210d4fb173f99e082c5b19dd999131d400daed72015be9`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [ee943c37](https://github.com/openshift/os/commit/ee943c37e640fcc5812d4a2a20ac66d57984e79c) `sha256:37a6f212bd688518c8b361563f0bde3353d6fb0fa7d996e36e750f4b1459a256`
* [tools](https://github.com/openshift/oc) git [02b0b2d9](https://github.com/openshift/oc/commit/02b0b2d9994a35535b710dd51ac604ed47b29bc9) `sha256:5d44a3b19601304824c82cb302a575d2ffa8e7085d02abfaae925af1b2908eaf`


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/1d6fb8798544b0d0ff60582f82f885e5a6a776ba)

* [OCPBUGS-80538](https://issues.redhat.com/browse/OCPBUGS-80538): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#44](https://github.com/openshift/azure-kubernetes-kms/pull/44)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/b381b8484ed76f9fba0ac993bc03d216e11c254c...1d6fb8798544b0d0ff60582f82f885e5a6a776ba)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/006a3edb4eec250bc414da316d912fc5231d195b)

* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Add configuration override for X-SSL strip [#1472](https://github.com/openshift/cluster-ingress-operator/pull/1472)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/d14c13be1685e74b898b93a3fa7e03e9b75aa174...006a3edb4eec250bc414da316d912fc5231d195b)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/00259384502230d2c5b463dcda8a5c05caf2154e)

* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): scc: Grant authenticated users use of restricted-v3 [#1950](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1950)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/aa9bd6a74ac8b3c9918581b5e49f8e7cf0109862...00259384502230d2c5b463dcda8a5c05caf2154e)


### [console](https://github.com/openshift/console/tree/5542b01c6a4bf138b1f055436bd685846df49340)

* [OCPBUGS-79455](https://issues.redhat.com/browse/OCPBUGS-79455): Bump immutable [#16323](https://github.com/openshift/console/pull/16323)
* [Full changelog](https://github.com/openshift/console/compare/f02ca58a2c598fafa277fbba7f632bae7afea4fd...5542b01c6a4bf138b1f055436bd685846df49340)


### [haproxy-router](https://github.com/openshift/router/tree/40c34581a02ca043d454034e376771c12d2e995c)

* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Strip X-SSL-* headers for plain HTTP [#797](https://github.com/openshift/router/pull/797)
* [OCPBUGS-87220](https://issues.redhat.com/browse/OCPBUGS-87220): Replace HTTP backend liveness check with admin socket check [#789](https://github.com/openshift/router/pull/789)
* [Full changelog](https://github.com/openshift/router/compare/cdfa172b2373257fdca5b8e7546378a2e762411c...40c34581a02ca043d454034e376771c12d2e995c)


### [hypershift](https://github.com/openshift/hypershift/tree/f8eff30f6d6a353da6ea9d1e581afb82d5ce57b6)

* [OCPBUGS-77967](https://issues.redhat.com/browse/OCPBUGS-77967): fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes [#8716](https://github.com/openshift/hypershift/pull/8716)
* [OCPBUGS-86780](https://issues.redhat.com/browse/OCPBUGS-86780): [release-4.20] OCPBUGS-81671: Ignition generalize image download errors [#8573](https://github.com/openshift/hypershift/pull/8573)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Add KAS readiness sidecar to OAS, OAuth API Server, and OLM packageserver [#8529](https://github.com/openshift/hypershift/pull/8529)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs [#8528](https://github.com/openshift/hypershift/pull/8528)
* [Full changelog](https://github.com/openshift/hypershift/compare/6a78b42be85d0d1f9f2c7fc3bf8320fd1d1bc2d3...f8eff30f6d6a353da6ea9d1e581afb82d5ce57b6)


### [insights-operator](https://github.com/openshift/insights-operator/tree/4186296303bbe4cf3f276dedf794a69a0723f18b)

* [OCPBUGS-87870](https://issues.redhat.com/browse/OCPBUGS-87870): extractor controller [#1304](https://github.com/openshift/insights-operator/pull/1304)
* [Full changelog](https://github.com/openshift/insights-operator/compare/e2549a52f29ae3365d14a9939cc135adfe0b0372...4186296303bbe4cf3f276dedf794a69a0723f18b)


### [ironic](https://github.com/openshift/ironic-image/tree/8a34de9553deadf506244f840827f63f058eef1d)

* Bugs OCPBUGS-82295 OCPBUGS-84371: Update sushy and Ironic to resolve ARM SuperMicro boot, Cisco vMedia Insert and BIOS Settings update issues. [#830](https://github.com/openshift/ironic-image/pull/830)
* [Full changelog](https://github.com/openshift/ironic-image/compare/4b0fc45cf7fc14d8095cea3ac96d724f199996d8...8a34de9553deadf506244f840827f63f058eef1d)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/d0d6ce62b4b7ba63529b9e400cf8ec72fa4589a6)

* [OCPBUGS-86864](https://issues.redhat.com/browse/OCPBUGS-86864): Verify extension packages are installed [#6114](https://github.com/openshift/machine-config-operator/pull/6114)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/1bee530c4d08401d07454a259a5ee430edb5216b...d0d6ce62b4b7ba63529b9e400cf8ec72fa4589a6)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/5099b7a44ecd77b95c1cea215797c48b7a3e913d)

* [OCPBUGS-88372](https://issues.redhat.com/browse/OCPBUGS-88372), [OCPBUGS-88383](https://issues.redhat.com/browse/OCPBUGS-88383), [OCPBUGS-88392](https://issues.redhat.com/browse/OCPBUGS-88392), [OCPBUGS-88428](https://issues.redhat.com/browse/OCPBUGS-88428), [OCPBUGS-88430](https://issues.redhat.com/browse/OCPBUGS-88430), [OCPBUGS-88446](https://issues.redhat.com/browse/OCPBUGS-88446): CVE-2026-44487 bump axios to 1.16.0 [#1000](https://github.com/openshift/monitoring-plugin/pull/1000)
* [OCPBUGS-84289](https://issues.redhat.com/browse/OCPBUGS-84289): bump follow-redirects to 1.16.0 [#986](https://github.com/openshift/monitoring-plugin/pull/986)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/8e62a3b707c4ebccd974810f977b37286e9ba043...5099b7a44ecd77b95c1cea215797c48b7a3e913d)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9b186403c88394b54ab491871a158a124df39a02)

* Fix for OCPBUGS-81937: CVE-2026-34986 github.com/go-jose/go-jose/v4 [#1427](https://github.com/openshift/oc-mirror/pull/1427)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/aaa36d6ba97b65a0b7a83f246ecf4bff70b938d1...9b186403c88394b54ab491871a158a124df39a02)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/eda815e0515550890354dda41e65f8dd35e15ad5)

* [OCPBUGS-82867](https://issues.redhat.com/browse/OCPBUGS-82867): Address CVE-2026-35469 [#652](https://github.com/openshift/openshift-apiserver/pull/652)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/34cb4762e1716c1a31a344118b8a3ad00c28d831...eda815e0515550890354dda41e65f8dd35e15ad5)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/e02cc75645fbc8981239e4144da1cd4dd98b1b17)

* [OCPBUGS-85366](https://issues.redhat.com/browse/OCPBUGS-85366): ANP-Skip redundant status updates to reduce API server load [#3183](https://github.com/openshift/ovn-kubernetes/pull/3183)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/24316b97b964e7de7aa2d7272aa8adc963ea9679...e02cc75645fbc8981239e4144da1cd4dd98b1b17)


### [tests](https://github.com/openshift/origin/tree/53118e346434dcf090c1c350564c194a59a571b1)

* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): tests: authorization/rbac: Align restricted-v3 rule [#31285](https://github.com/openshift/origin/pull/31285)
* [Full changelog](https://github.com/openshift/origin/compare/0d4dc5038f9b63feb8cd3bd4c25676ba8cd2f433...53118e346434dcf090c1c350564c194a59a571b1)