4.18.56

Download the installer for your operating system or run

oc adm release extract --tools quay.io/openshift-release-dev/ocp-release:4.18.56-x86_64

Qualifiers (status api):

Tests:

Blocking jobs
- upgrade Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
- upgrade-minor Succeeded periodic-ci-openshift-release-main-stable-4.y-e2e-aws-ovn-upgrade
Informing jobs
- aws-ovn-serial Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-ovn-serial
- aws-ovn-single-node-upgrade-4.18-micro Failed (1 retry) periodic-ci-openshift-release-main-ci-4.18-e2e-aws-upgrade-ovn-single-node
  - Attempt 1 Failed
  - Attempt 2 Failed
- aws-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-aws-ovn-upgrade
- azure-ovn-upgrade-4.18-micro Succeeded periodic-ci-openshift-release-main-ci-4.18-e2e-azure-ovn-upgrade
- driver-toolkit Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-aws-driver-toolkit
- fips-scan Succeeded periodic-ci-openshift-release-main-nightly-4.18-fips-payload-scan
- gcp-ovn-rt-upgrade-4.18-minor Succeeded periodic-ci-openshift-release-main-ci-4.18-upgrade-from-stable-4.17-e2e-gcp-ovn-rt-upgrade
- hypershift-ovn-conformance-4.18 Succeeded periodic-ci-openshift-hypershift-release-4.18-periodics-e2e-aws-ovn-conformance
- metal-ipi-ovn-ipv4 Succeeded (1 retry) periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv4
  - Attempt 1 Failed
  - Attempt 2 Succeeded
- metal-ipi-ovn-ipv6 Succeeded periodic-ci-openshift-release-main-nightly-4.18-e2e-metal-ipi-ovn-ipv6
- microshift-ovn-conformance-parallel Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance
- microshift-ovn-conformance-serial Succeeded periodic-ci-openshift-microshift-release-4.18-periodics-e2e-aws-ovn-ocp-conformance-serial

Upgrades from:

Untested upgrades: 4.17.14, 4.17.15, 4.17.16, 4.17.17, 4.17.18, 4.17.19, 4.17.20, 4.17.21, 4.17.22, 4.17.23, 4.17.24, 4.17.25, 4.17.26, 4.17.27, 4.17.28, 4.17.29, 4.17.30, 4.17.33, 4.17.34, 4.17.35, 4.17.36, 4.17.37, 4.17.38, 4.17.39, 4.17.40, 4.17.41, 4.17.42, 4.17.43, 4.17.44, 4.17.45, 4.17.46, 4.17.48, 4.17.49, 4.17.50, 4.17.51, 4.17.52, 4.17.53, 4.17.54, 4.17.55, 4.18.10, 4.18.11, 4.18.12, 4.18.14, 4.18.15, 4.18.17, 4.18.18, 4.18.19, 4.18.20, 4.18.21, 4.18.22, 4.18.23, 4.18.24, 4.18.25, 4.18.26, 4.18.27, 4.18.28, 4.18.29, 4.18.30, 4.18.31, 4.18.32, 4.18.33, 4.18.34, 4.18.35, 4.18.36, 4.18.37, 4.18.38, 4.18.39, 4.18.4, 4.18.41, 4.18.42, 4.18.43, 4.18.44, 4.18.45, 4.18.46, 4.18.47, 4.18.48, 4.18.49, 4.18.5, 4.18.50, 4.18.51, 4.18.52, 4.18.6, 4.18.7, 4.18.8, 4.18.9

Upgrades to:

4.19.49 (changes) - Success
4.19.0-0.ci-2026-09-24-163443 (changes) - Failed Pending

Loading changelog, this may take a while ...

Changes from 4.18.40

Created: 2026-09-24 11:49:13 +0000 UTC

Image Digest: sha256:630c143e63c6024267bf6f66cfc7c84366eb8a9dc022eaf7b411b8e1474ca183

Components

Kubectl 1.31.1
Kubernetes 1.31.14
Kubernetes Tests 1.31.12
Red Hat Enterprise Linux CoreOS upgraded from 418.94.202605042017-0 to 418.94.202609171815-0 (diff)

Removed images

ovirt-csi-driver
ovirt-csi-driver-operator

Rebuilt images without code change

agent-installer-node-agent git 81c09fb7 sha256:8297f799e8062f64b03cdcd6171fa73494bbc3c3cb857957065f4fb3ea6892bc
agent-installer-utils git 63b87f06 sha256:e5fc274ce27cfe2c023b6dc9c0d4ab9e20fdbc4a8ad7291f9074d00a91b572fc
apiserver-network-proxy git 2f62712d sha256:633e87ff8ac3725f9809f2b7cd82cbabb0ea65be2069b5d0c6cdd2561c62129d
aws-cloud-controller-manager git c3951906 sha256:5237b161c07608a0a910ea502ac2e3e27dd5b929b8b03274dc183e6ab2ed9fc6
aws-machine-controllers git 7b6bfc74 sha256:718280b5f1cdd05be9209eb424366f45dbbd3a56ac26061384c1acd0e381b423
aws-pod-identity-webhook git f54f9a19 sha256:cabc4695b2d670a982871198421a28a5f2fe527ea564c58e1300bfdc05cefc38
azure-machine-controllers git 2fdaa544 sha256:5cc591ffc5bae13bc15bb6c200d63bca8ae4daff905622f1c61ab770f971cb62
azure-workload-identity-webhook git f60e4029 sha256:4f0de1c2e1da4c014a664a9f0c5d3e5bb673fee2ccad2c25bf8d3fbde88e4cac
baremetal-cluster-api-controllers git 80c3a063 sha256:8fca1ffa8fb74410ddc12c6915218b8a202184d856ea751c1dbd9e7de255619c
baremetal-machine-controllers git 1ede6c3f sha256:4c9eb3052c75bf720110d2fc0975bb1b10f547c35109738279e811024cb91406
baremetal-runtimecfg git 35341068 sha256:0ef3ed8db585e8ffa10f201c52899c0618f84c4755926bd3da96356ac4fccb47
cloud-network-config-controller git f892b915 sha256:1ff45f8322807f5b0886fdb298769c162269511117549f312b207f987e63ef70
cluster-autoscaler git 34730793 sha256:905e1511abcad29623c8a783bd4ed1d4d1a44b5f256152aacc866cf0ea64c02c
cluster-baremetal-operator git 3e6d1ab1 sha256:05fed167b21fc9089f51969f25a5a3998a9e0b5fcfd23e84f1ccda181e144885
cluster-bootstrap git d1e01954 sha256:af71b643e4bdebabf100c3322582acdf54131910c378a56f4287e653b64c7224
cluster-cloud-controller-manager-operator git 8abb0673 sha256:c1930fb510f8c997e2567eec239329453e8eb75afa7f820eb21f52dc79d2da08
cluster-config-operator git fe5e9286 sha256:adb7b08e78cbe0a32ff4b5618d248063a0d1971203160a4d0030ee3f8b11ec31
cluster-control-plane-machine-set-operator git d17bf3a1 sha256:db72696f42116b248c4ecad504f0cb02821c6fecc51663904f5a8d016b109419
cluster-csi-snapshot-controller-operator git 6fe70008 sha256:36c654caaeeca54fff2902df48e0f6921ee0e2bcd5af09044b7a95921fc2b2fe
cluster-dns-operator git 7cafd0c7 sha256:8820bb7aea15bb270b44228613842926d42c4a29bc39926fc9047bd7a9f4ac47
cluster-etcd-operator git 3af8b9d6 sha256:32f3e08bb4ed7387a2dbddf8475d763b82362aceea53f614dcaee561ac282fd0
cluster-image-registry-operator git 1e3caa4b sha256:92da3323bb9520629bf1c32abb981f9587abb2ac9689bfba7e5ede64bbb8dbc1
cluster-kube-apiserver-operator git e9bc9090 sha256:6121fda4ba12a8b51a5db50888e7c7898c4b1fc351a761cc4b381bd60ca605f4
cluster-kube-controller-manager-operator git 6347fc81 sha256:c1b93cfa99d0906b6fb237e953a3468e0c74b27c11c32b15c1d93083382fd715
cluster-kube-scheduler-operator git 4e99db62 sha256:0c8bb262917b30f0918f20b5d07e35b5bf56450d05161b1743ffcd2a847e0dda
cluster-kube-storage-version-migrator-operator git 59ba356f sha256:faeb660b12e1b9acd399e08fc9311951f73ddeb7810718cde617d2e40da670b3
cluster-machine-approver git 01d5fbbe sha256:f6b51f2e91ece9c565b70a1d132aa6375cb7f691b48a0aeb04f423e98ee6c818
cluster-openshift-apiserver-operator git 0a6f6eb9 sha256:b0a0531f33197215c334d5e7ba1f31a8c61b25a796c8162f70d3bb4ec32d3bcb
cluster-openshift-controller-manager-operator git f1711cf3 sha256:2bdca43bc4e942945f24486f462a7d2d6147280a0d6f6a0149f8b003678fc24b
cluster-samples-operator git bc725fd4 sha256:4b6259f84433cbdba4a86cd8bfc804d99ea699f833786a0909b282cb3f3473f0
cluster-update-keys git 8caab452 sha256:d3397ada3225efc31cf5223c3df0d783a2eade24830e6c8e9728cc498a26d293
cluster-version-operator git f72d7e2c sha256:0d39f044465d1947ea36978710ae479ffab010ee7f4dc7f329f57f128e403ce4
configmap-reloader git e2aaf00a sha256:4ae0ccb0e082698f48990d8f2321b031a77b538cc5c3e65e0456b9eed95f0447
coredns git 8ca7f02b sha256:143c2654174a037756ecfaa15a8e30dd00737dfaad4fece2ff596b1c40ec5373
csi-livenessprobe git 3a977844 sha256:5ee967e6bbb73689bc6cddb1d472004731f5f972a5f890e5e21c2ffa725778fa
csi-node-driver-registrar git ef93f0be sha256:203a8b88d1c51b64f08a29e1d488ab12a1e0b6decc5aba923d9d5849b9452275
docker-builder git 529c9688 sha256:7010d59bb8e445a87c7a3b5d9693a3ea895c4a9e4ce615f6d3dc06a56fad780e
docker-registry git 5c367551 sha256:3b5b30a101040fab27483818ce6b5c87a3f5a9d5b831fb3c76ea6dd633f93396
driver-toolkit git 2e139edc sha256:f73f16d8bd5ad0f549eb6113dc23bde3b8fd608dc03dbef00ddf4ddaf5ea97b6
etcd git b5a4f8d0 sha256:a50c206f3ecb9e4680c471c33e3802f93333e0961ea6b1b08d93504a44befd18
gcp-cloud-controller-manager git 6ea23561 sha256:a425ec37ee6d59dd711760af9005f2a3dfc5c1b065ec45d5e3f14e650c4d44f4
gcp-workload-identity-federation-webhook git f0a670c7 sha256:6e4118e3fe9255e72bc6cc86b7c7d98a1166656c47cc52d5bf7b64cc39646c40
hyperkube git 91c24081 sha256:47776a5e6527c76364016ab6e37d3137635c929ba3046c5d83ea6efad2bc0e33
ibm-cloud-controller-manager git a33026b1 sha256:6ad04104f92a8c651953dc9111d3ea2ca4d9f19da7bc40b1f38a0b63f5497fcd
ibm-vpc-block-csi-driver-operator git 1c7bc07e sha256:7a007b41424e7496e222341fe9459a8a477dc469487dab1fa3472f4f4f349f06
insights-runtime-exporter git 3d444833 sha256:4120e9d7ccb163fae9f022ab3075ea3a2d91ae88f62bff617a871f1249d2fc54
insights-runtime-extractor git 3d444833 sha256:01dd561a291b3633c4dd22998d60273a07093ed41d7072825033c6c5d83b6c5e
ironic-machine-os-downloader git 50ca44fd sha256:44edb998625a71531b2887d923491d394dfdbf1617b03aa3285744f15422d702
ironic-static-ip-manager git cfbae04f sha256:22be9c9c6548fb4d6024ab970e3af746b5461d54cc4dda132b0869caa40eea13
keepalived-ipfailover git 716eb0ef sha256:0ce26a62345c356137307c5cafd436b9745004c5b9cd8c36adae22382b74abc1
kube-proxy git 91c24081 sha256:624553b7912c317e1dd02a7ec7020cb9805c8bb6cd1cf259569e4d19bdc67ae8
kube-state-metrics git 046193a8 sha256:0fad4622f3cf42083b6523add53bef76e60e265c1fa30d17718518b632f9b8f5
kube-storage-version-migrator git 815b43b7 sha256:739831d0b3dfe66d8286efecc11b59cf0be3330cbc99337f64934b678db15faf
libvirt-machine-controllers git 875b03bd sha256:fff42491884723294bb8d4088e8e42fe91f17fff1d572afea44307a7cba4854e
machine-api-operator git b3a96a46 sha256:0fdb011e4fe29ecde86293ccaf68febf90957ef01d46f7f72aac10ef3d84f5db
machine-image-customization-controller git c8569da6 sha256:415a3cf78fb233e2a3bc659fb6a1f5c1a27693c9c22fdbb3dc32072036d72b87
metallb-frr git 760c6639 sha256:c25b2560de15dbb81b90b6e3931f3ac502b2c3465658c62ab7da3ebb2b360fde
multus-admission-controller git 0d7ea6c7 sha256:e7fc1226544b2c0fccbbeabc31898674b6121a85965113f74854f57f0af101db
multus-networkpolicy git 3362bbc4 sha256:77ef0d42d766a44bd88cee061a6e995745a72bbff32fbfbdadebbe6052187602
multus-route-override-cni git 391c1b03 sha256:717ee27b5abc5298d4d859cc988e1f949026ecaa9771258d3097f71845a77590
multus-whereabouts-ipam-cni git 86191ded sha256:c2c8b78620ed5c0450145465ac185fab4bec5ec94af28d57814bbabe1ca72068
network-interface-bond-cni git e2de9255 sha256:236731ae40fd60a596e6ba46152607b3b0997cfd205bb3255d678d079eb89261
network-metrics-daemon git 11e2dec9 sha256:78a7901a8ee7e36ee9d233484ae902df5b0509754cf09f96e1aeac423c1225b8
network-tools git 47b13549 sha256:2d8dfc5aed8882287ecf4521066247d461c940d06bc13ac14ccf10f5827f3dcd
nutanix-cloud-controller-manager git d9fe8f38 sha256:4462b88a594a80fb03b6c5ca4e545ea030e23c46fa3ef0181a924f4d58b0ffec
nutanix-machine-controllers git afe324bf sha256:72dcd5cf8d5471384d9780b3f7982bad2d00dfd4a7beb869a12720d29cf6a822
oauth-apiserver git 1078b191 sha256:4cae885dceb6c0e7a25da23933f116d925e071a2962e79ea4e07cc27fe705c4f
oc-mirror git 22a9fb87 sha256:cae427b37a475b5581f926c7382bb5611bd5ddb633e2ab335cc0c944b95e3634
olm-catalogd git 180aa92c sha256:7f18915601fb92ce1374914d79ed93ff1dfc07058f5baf67cbd013cb07564fc5
openshift-controller-manager git 8ee74406 sha256:f65dfdc5e03313716589c233479236e6c6aead19364c956b66bfe5a9488e80da
openshift-state-metrics git 3cca6fee sha256:2e0d9261a8cbef07d3eba049853f33b4eba6d8a08dc65d2339fb828dddbd383e
openstack-cluster-api-controllers git d5e6ff9f sha256:0152ee983f7b70e083e70e9414a724ecd7db1ab438a11faa3c26c90edfbc5518
operator-marketplace git 34521c26 sha256:24e38f3aa6122d52dd0f93eb550aee98b3b377c5c8d87a8efc2afd352b41996f
pod git 91c24081 sha256:709f15a3ff0ede612751cc885dd9adfee24c36e25fac7d9d97c190b0cddcebc1
powervs-block-csi-driver git e8700dfa sha256:f6810ff5c6fc04241084e26a2e1a7acc34eabd0bf9ac472f2ec830d31ad862ec
powervs-block-csi-driver-operator git 9c9131b7 sha256:e902b6ed025ae55b2bebf64e4e65927b239194d7d8642b477b2cf966f37fc895
powervs-machine-controllers git 74e3ece7 sha256:f4b35c9586dad262b17739949c6e8843c0acde7de30694cad5ad6001ef312689
prom-label-proxy git 35c11369 sha256:786410b7b672952bdf63861d129fd9d30278b57c4d57c7d9745a71daa82a744b
prometheus-node-exporter git 92e17ff5 sha256:53bbb3ad76811194793dccef010fd04e1de57ba1ba9acb5b14032dfbd808f905
rhel-coreos sha256:d45007bd5e6fcf1c27652d8c69ae2863ea36942c9ebc101b5111f2cb1886a309
rhel-coreos-extensions sha256:e92c4728efed5b348a99625734ecf891911a66ab63b066cf37eafcae7eecf114
service-ca-operator git 30efb529 sha256:99e9607b6e6ed6711bb8a73f554bffb278b7f7706a9a0e58f702345279185925
tests git 43c51244 sha256:327d66901a448034753a1955df634ae4cfad7de2e86c2b5656b833923f4aa5d6
vsphere-cloud-controller-manager git b4dbf34a sha256:dad2514cef77554fb04f7c8944ea8407017cc0add069bca729d6bc207e57e96b

agent-installer-api-server

OCPBUGS-89884: patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 #10800
Full changelog

agent-installer-csr-approver, agent-installer-orchestrator

OCPBUGS-103348: Bump x/net to v0.35.0-sec.4 #2297
Full changelog

aws-cluster-api-controllers

🐛 OCPBUGS-123705: UPSTREAM: <carry>: Fix unit tests for OpenShift CI environment #642
🌱 OCPBUGS-123680: UPSTREAM: <carry>: Remove upstream .github files unused in OpenShift CI #641
Full changelog

aws-ebs-csi-driver

OCPBUGS-82745: Address CVE-2026-35469 #327
OCPBUGS-86167: UPSTREAM: 2367: cleanup: make verify should ignore copyright year #321
OCPBUGS-80206: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 #313
Full changelog

aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator

OCPBUGS-103360, OCPBUGS-103371: CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork #610
OCPBUGS-80308: Bump google.golang.org/grpc #542
Full changelog

aws-kms-encryption-provider

OCPBUGS-80184: Bump google.golang.org/grpc to v1.79.3 #43
Full changelog

azure-cloud-controller-manager, azure-cloud-node-manager

OCPBUGS-80210, OCPBUGS-80211, OCPBUGS-80350: Bump google.golang.org/grpc to v1.79.3 #190
Full changelog

azure-cluster-api-controllers

OCPBUGS-89899: Address CVE-2026-39829 #401
OCPBUGS-80212: Bump google.golang.org/grpc to v1.79.3 #390
Full changelog

azure-disk-csi-driver

OCPBUGS-114621: UPSTREAM: 3277: fix: allow . in Azure tags #179
OCPBUGS-80213: Address CVE-2026-33186 #142
OCPBUGS-78037: add instantAccessDurationMinutes parameter to enable IA snapshots for PremiumV2/UltraSSD disks #130
Full changelog

azure-file-csi-driver

OCPBUGS-103366: Bump golang.org/x/net to v0.35.0-sec.4 #158
OCPBUGS-92789: Bump golang.org/x/crypto to v0.33.0-sec.3 #148
OCPBUGS-80216: Address CVE-2026-33186 #133
Full changelog

azure-kms-encryption-provider

OCPBUGS-80185: Bump google.golang.org/grpc to 1.64.1-sec.1 patch #46
Full changelog

baremetal-installer, installer, installer-altinfra, installer-artifacts

OCPBUGS-77052: Update RHCOS-release-4.18 bootimage metadata to 418.94.202608142238-0 #10795
OCPBUGS-95616: azure: Add field in installconfig to disallow shared access key #10670
Full changelog

baremetal-operator

OCPBUGS-98321: Add BMH finalizer on PreprovisioningImage #509
OCPBUGS-59259: Fix HFC error handling in actionPreparing #502
OCPBUGS-87967: Fix preprovisioning network Secret lifecycle during BMH deletion #495
Full changelog

cli, cli-artifacts, deployer, tools

OCPBUGS-91365, OCPBUGS-94688: Bump golang.org/x/net to openshift-sustaining/net v0.35.0-sec.2 #2344
OCPBUGS-109669: Fix pre-existing unit test failures on release-4.18 #2372
Full changelog

cloud-credential-operator

OCPBUGS-81887: Bump go-jose/go-jose/v4@v4.1.4 #1031
OCPBUGS-80219: Fix CVE-2026-33186 using openshift-sustaining grpc-go fork #1041
Full changelog

cluster-authentication-operator

OCPBUGS-75897: set appropriate rolling update settings #835
Full changelog

cluster-autoscaler-operator

OCPBUGS-103386: Bump x/net package in release-4.18 #388
Full changelog

cluster-capi-controllers

OCPBUGS-80220: Bump google.golang.org/grpc to v1.79.3 #297
Full changelog

cluster-capi-operator

OCPBUGS-80224: Bump google.golang.org/grpc to v1.79.3 #566
NO-JIRA: Allow sustaining engineering to self serve dependency updates #558
Full changelog

cluster-config-api

OCPBUGS-98486: add new serviceAccountToken fs type #2927
Full changelog

cluster-ingress-operator

OCPBUGS-103414: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1571
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

cluster-kube-cluster-api-operator

OCPBUGS-80231: Bump google.golang.org/grpc to v1.79.3 #77
Full changelog

cluster-monitoring-operator

OCPBUGS-103412: [release-4.18] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame #3075
OCPBUGS-105311: [release-4.18] wrap library-go resourceCache with mutex for thread safety #3041
OCPBUGS-104540: Backport e2e stabilization 4.18 #3030
OCPBUGS-100375: [release-4.18] fix: watch cluster wide proxy changes and apply changes accordingly #3024
OCPBUGS-94081: ship collector:node_scrape_collector_success:avg to Telemetry #2992
OCPBUGS-86995: increase lookup interval #2944
Full changelog

cluster-network-operator

OCPBUGS-100191: Bump github.com/containernetworking/cni v0.8.0 -> v1.3.0 #3096
OCPBUGS-85443: Remove duplicated openssl parameter #3006
OCPBUGS-84869: wait for patch port to apply drop garp flows #2988
Full changelog

cluster-node-tuning-operator

OCPBUGS-90575: Requeue PerformanceStatus update when status write fails #1552
OCPBUGS-82752: Bump github.com/moby/spdystream from v0.4.0 to v0.5.1 #1544
Full changelog

cluster-olm-operator

OCPBUGS-80239: Bump google.golang.org/grpc to v1.79.3 #200
Full changelog

cluster-policy-controller

OCPBUGS-98486: Backport fs type service account token 4.18 #196
Full changelog

cluster-storage-operator

OCPBUGS-87556: remove oVirt code from CSO 4.18 #707
Full changelog

console

OCPBUGS-113759: block GraphQL introspection over websocket #17130
Fix for OCPBUGS-92075: CVE-2026-44990 #16717
OCPBUGS-100515, OCPBUGS-101791: Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss #17058
OCPBUGS-98420: [release-4.18] CVE-2026-59869 bump js-yaml #17076
OCPBUGS-81520: Console can only show user name instead of full name as the display name #16238
OCPBUGS-86740, OCPBUGS-87085, OCPBUGS-97763: [release-4.18] bump package: protobufjs, fast-uri #16728
OCPBUGS-100069: quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN) #16872
OCPBUGS-91944: Prevent binary secret data corruption when editing #16673
OCPBUGS-99487: Disable Knative e2e Cypress tests in CI #16803
OCPBUGS-99648: Disable shipwright e2e tests to unblock CI #16818
OCPBUGS-86453: [release-4.18] shell-quote: Arbitrary code execution via command injection due to unescaped line terminators #16511
Fix for OCPBUGS-81604: CVE-2026-4800 #16563
OCPBUGS-84284: Bump follow-redirects to 1.16.0 to fix CVE-2026-40895 #16675
OCPBUGS-77125: [release-4.18] CVE-2026-26996 Bump minimatch library #16344
OCPBUGS-79447: Bump immutable #16325
NO-JIRA: enable multi-architecture yarn builds #16421
Full changelog

console-operator

OCPBUGS-98985: [4.18] Stabilize telemetry config to prevent continuous console pod rollouts #1190
Full changelog

container-networking-plugins, containernetworking-plugins-microshift

OCPBUGS-85672: CI Build root image tag sync with ART #236
Full changelog

csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager

OCPBUGS-80309: Bump google.golang.org/grpc #387
Full changelog

csi-driver-nfs

OCPBUGS-82754: Bump github.com/moby/spdystream@v0.5.1 #194
OCPBUGS-80254: Replace google.golang.org/grpc with github.com/openshift-sustaining/grpc-go v1.71.3-sec.1 to avoid go version bump and fix CVE-2026-33186 #180
Full changelog

csi-external-attacher

OCPBUGS-80255: Bump google.golang.org/grpc to v1.79.3 #105
Full changelog

csi-external-provisioner

OCPBUGS-82755: Address CVE-2026-35469 #135
OCPBUGS-80256: Bump google.golang.org/grpc #130
Full changelog

csi-external-resizer

OCPBUGS-103430: Bump golang.org/x/net to v0.35.0-sec.4 #213
OCPBUGS-80257: Bump google.golang.org/grpc to v1.79.3 #203
Full changelog

csi-external-snapshotter, csi-snapshot-controller, csi-snapshot-validation-webhook

OCPBUGS-80258, OCPBUGS-80261, OCPBUGS-80262: Bump google.golang.org/grpc to v1.79.3 #211
Full changelog

egress-router-cni

OCPBUGS-100191: Bump containernetworking/cni to v1.3.0 github.com/containernetworking/plugins to 1.4.0 #109
Full changelog

gcp-cluster-api-controllers

OCPBUGS-80270: Bump google.golang.org/grpc to v1.79.3 #290
Full changelog

gcp-machine-controllers

OCPBUGS-103482: Bump golang.org/x/net to v0.35.0-sec.3 #189
OCPBUGS-80293: Bump google.golang.org/grpc to v1.79.3 #165
Full changelog

gcp-pd-csi-driver

OCPBUGS-80274: Bump google.golang.org/grpc to v1.71.3-sec.1 in release-4.18 #112
Full changelog

gcp-pd-csi-driver-operator

OCPBUGS-80273: Replace google.golang.org/grpc with fork #187
Full changelog

haproxy-router

OCPBUGS-86726: Prevent SSRF via FQDN-typed EndpointSlices #821
OCPBUGS-86715: Strip X-SSL-* headers for plain HTTP #800
OCPBUGS-80275: Bump google.golang.org/grpc to v1.79.3 #768
Full changelog

hypershift

fix(deps): OCPBUGS-76288: Update runc, selinux, and their transitive deps to fix CVE-2025-52881 #8289
ACM-37663: Rebase hypershift operator runtime image to RHEL 9.8 ELS #9451
ACM-38044: update Containerfile.cli base images to floating tags [release-4.18] #9044
OCPBUGS-99142: fix(backport): konnectivity agent auth #9096
OCPBUGS-62756: Restart HCP on stale serving certs #8245
OCPBUGS-89356: build(operator): drop hypershift-no-cgo from operator container images #8760
NO-JIRA: remove path filter from control-plane-operator pipelines #8665
OCPBUGS-80278: fix CVE-2026-33186 by replacing grpc-go #8515
OCPBUGS-84180: fix(cno): use brackets only for IPv6 in server URL #8346
Full changelog

ibm-vpc-block-csi-driver

OCPBUGS-80280: Bump google.golang.org/grpc to v1.79.3 #143
Full changelog

ibmcloud-cluster-api-controllers

OCPBUGS-103453: Replace golang.org/x/net with openshift-sustaining/net #172
OCPBUGS-115513: Fetch envtest assets from the controller-tools releases #183
Full changelog

ibmcloud-machine-controllers

OCPBUGS-103467: replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 #104
OCPBUGS-41223: Updating ose-ibmcloud-machine-controllers-container image to be consistent with ART for 4.18 #45
NO-JIRA: vendor golint instead of relying on the CI build root #115
Full changelog

insights-operator

OCPBUGS-80283: Bump google.golang.org/grpc to v1.79.3 #1283
Full changelog

ironic

OCPBUGS-88475: Updating openstack-ironic commit that fixes CVE-2026-43003 #903
OCPBUGS-105860: update ironic pin to include CVE-2026-54423 fix (release-4.18) #893
OCPBUGS-100164: Update openstack-ironic commit hash for CVE-2026-44918 #888
OCPBUGS-76459: Bump pyasn1 to 0.5.1-4 #826
Full changelog

ironic-agent

OCPBUGS-99888: Correct ironic-python-agent pin to include the CVE-2026-66138 fix #314
OCPBUGS-88475: Update openstack-ironic-python-agent commit hash that address CVE-2026-43003 #313
OCPBUGS-99888: Bump ironic-python-agent pinned commit for CVE-2026-66138 #308
OCPBUGS-95066: Replace individual package removal with a single rpm -e loop #286
OCPBUGS-95066: Replace dnf remove with rpm -e to prevent dependency removal #274
Full changelog

kube-metrics-server

OCPBUGS-80190: Bump google.golang.org/grpc to v1.79.3 #64
Full changelog

kube-rbac-proxy

OCPBUGS-39450: Updating kube-rbac-proxy-container image to be consistent with ART for 4.18 #105
Full changelog

kubevirt-cloud-controller-manager

OCPBUGS-39554: Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.18 #45
OCPBUGS-95084: OWNERS: Update component to Cloud Compute / KubeVirt Provider #77
Full changelog

kubevirt-csi-driver

OCPBUGS-80191: Bump google.golang.org/grpc to v1.79.3 #101
Full changelog

machine-config-operator

OCPBUGS-122250: Add missing verb in MCC RBAC #6540
OCPBUGS-105477: Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole #6391
OCPBUGS-94116: move cleanUpDuplicatedMC to avoid double reboot on first updated #6249
OCPBUGS-91747: Verify extension packages are installed #6216
OCPBUGS-98445: Remove sensitive ControllerConfig logging #6294
OCPBUGS-97588: Bootstrap MCS logging entire ignition #6268
OCPBUGS-86845: Apply password only if changes exist #6113
OCPBUGS-86695: use –delete-if-present for karg removal #6102
OCPBUGS-86844: Fix ssh and password rollbacks #6096
OCPBUGS-86692: Fix re-cordon detection #6101
OCPBUGS-86300: Add terminationMessagePolicy to build pod containers #6074
OCPBUGS-86021: Fix units rollback if update failure #6052
Full changelog

machine-os-images

OCPBUGS-87876: Add support for hermetic builds via Cachi2 prefetched CoreOS ISOs #100
Full changelog

monitoring-plugin

NO-JIRA: [release-4.18] Sanitize alert runbook URLs #1297
OCPBUGS-98772: [release-4.18] replace outdated react-linkify dependency #1179
OCPBUGS-74461: CVE-2025-13465 openshift4/ose-monitoring-plugin-rhel9: prototype pollution in _.unset and _.omit functions [openshift-4.18] #1141
OCPBUGS-79448: immutable bump: fix for CVE-2026-29063 #922
Full changelog

multus-cni, multus-cni-microshift

OCPBUGS-85249: Fix server url in kubeconfig #298
NO-ISSUE: [release-4.18] Bump Go to 1.22 and fix CI build root image #291
Full changelog

must-gather

OCPBUGS-86019: Collect object size with the object count #547
Full changelog

networking-console-plugin

OCPBUGS-98784: Updating linkify-it to 5.0.2 to fix CVE-2026-48801 #460
OCPBUGS-99991: Updating networking-console-plugin-container image to be consistent with ART for 4.18 #454
OCPBUGS-41880: Fix namespace retention between NetworkPolicies tabs when MultiNetworkPolicies are disabled #433
OCPBUGS-41880: Retain namespace selection between network policies tabs #424
OCPBUGS-87000: Update Dockerfile.art to 4.22 build image #426
OCPBUGS-83382: Fix CVE 2026 34043 serialize javascript 4.18 #413
[release-4:18] OCPBUGS-85067: Migration from yarn to npm #412
OCPBUGS-81606: Fix CVE-2026-CVE-2026-4800 in lodash #401
And 1 elided commits (e.g. from squash or rebase merges)
Full changelog

oauth-server

OCPBUGS-81803: Bump github.com/go-jose/go-jose/v3 from v3.0.3 to v3.0.5 #238
Full changelog

olm-operator-controller

OCPBUGS-100434: increase catalog HTTP client timeout from 10s to 5m #787
OCPBUGS-87830: [release-4.18] operator-controller: clean up orphaned temp dirs in catalog cache #751
OCPBUGS-80304: Update grpc-go to v1.71.3-sec.1 to fix CVE-2026-33186 #735
Full changelog

openshift-apiserver

OCPBUGS-82769: Address CVE-2026-35469 #657
Full changelog

openstack-machine-api-provider

OCPBUGS-93867: Revendor CAPO #174
Full changelog

operator-framework-tools, operator-lifecycle-manager, operator-registry

OCPBUGS-103497, OCPBUGS-103502, OCPBUGS-103503: Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 #1366
OCPBUGS-80311, OCPBUGS-80312, OCPBUGS-80313: Fix CVE-2026-33186 with openshift-sustaining/grpc-go v1.71.3-sec.1 [release-4.18] #1314
Full changelog

ovn-kubernetes, ovn-kubernetes-microshift

OCPBUGS-112810, OCPBUGS-113507: Branch Sync release-4.19 to release-4.18 [08-21-2026] #3410
OCPBUGS-105851: Branch Sync release-4.19 to release-4.18 [08-11-2026] #3386
OCPBUGS-82773: Bump github.com/moby/spdystream to v0.5.1 #3321
OCPBUGS-98957: Branch Sync release-4.19 to release-4.18 [07-09-2026] #3290
OCPBUGS-86230: Branch Sync release-4.19 to release-4.18 [05-19-2026] #3197
OCPBUGS-74399, OCPBUGS-85434: Branch Sync release-4.19 to release-4.18 [05-12-2026] #3184
Full changelog

powervs-cloud-controller-manager

OCPBUGS-80319: Replace google.golang.org/grpc with openshift-sustaining fork v1.71.3-sec.1 to v1.79.3 to fix CVE-2026-33186 #99
Full changelog

prometheus

OCPBUGS-88628: remote: validate snappy decoded length before allocation in read endpoint #346
OCPBUGS-80320: Bump google.golang.org/grpc to v1.79.3 #308
Full changelog