# 4.20.26

Created: 2026-06-18 12:36:01 +0000 UTC

Image Digest: `sha256:df8f0087646c952daae01c4f5ab625bdb95b317cfa790f6841309e8d131c6f89`


## Changes from 4.20.25

### Components

* Kubectl 1.33.3
* Kubernetes 1.33.12
* Kubernetes Tests 1.33.4
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260608-0 to 9.6.20260616-0


### Rebuilt images without code change

* [agent-installer-api-server](https://github.com/openshift/assisted-service) git [b2712866](https://github.com/openshift/assisted-service/commit/b271286656c2186ea8940ea6463da523f00094f0) `sha256:b9a359fca4093efb9deaf581963244e67abfc7afc3ec6df558cc1525adaed085`
* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [e3e997d9](https://github.com/openshift/agent-installer-utils/commit/e3e997d9f7b84b134a07186de9bddde21598ae32) `sha256:3e44064c6c2f51f5d59267cb3be081e525227b412f84cdf982239a7340c5a0b6`
* [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator) git [94d9ffd3](https://github.com/openshift/cluster-node-tuning-operator/commit/94d9ffd3ec8db4587884e13400bbc87d79c21da7) `sha256:ee697ce277502f25541e9973db31e142af9c4419849a50d0a020c61afcc48c33`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [62e1f604](https://github.com/openshift/driver-toolkit/commit/62e1f6040cd297149f5f14e0d20814759ec61354) `sha256:450a1c77d36771a98dfa96bb128a066192871becc7ff3edd5da3f9839de5b87b`
* [network-tools](https://github.com/openshift/network-tools) git [26d09174](https://github.com/openshift/network-tools/commit/26d09174cbd92386469e777e3bf49bfa95d035d5) `sha256:203ec72895a613490e467305fd2ad96e620d4ea8631b44117be4f7227cb3d162`
* [networking-console-plugin](https://github.com/openshift/networking-console-plugin) git [c9c1a9f5](https://github.com/openshift/networking-console-plugin/commit/c9c1a9f5ca8287d20a0aafab9507478c6f291614) `sha256:7acd95b189ae4b09922c757de90a1855a91ec8d185144ef19027bd0ff1c9f522`
* [rhel-coreos](https://github.com/openshift/os) git [ee943c37](https://github.com/openshift/os/commit/ee943c37e640fcc5812d4a2a20ac66d57984e79c) `sha256:ddf16905377b23c75c615aeb276d3300aab7bca00ad6d89457dcfb0491aaf7f1`
* [rhel-coreos-extensions](https://github.com/openshift/os) git [ee943c37](https://github.com/openshift/os/commit/ee943c37e640fcc5812d4a2a20ac66d57984e79c) `sha256:f3dee591b86c159857335b0ebd322f93dd9ac3093ae29975310f60b0c5b139f5`
* [tools](https://github.com/openshift/oc) git [02b0b2d9](https://github.com/openshift/oc/commit/02b0b2d9994a35535b710dd51ac604ed47b29bc9) `sha256:8d50532844d79c853a38a59c62ad4e6ea253e5ca6d54a81791b38922053f9ddd`


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/1d6fb8798544b0d0ff60582f82f885e5a6a776ba)

* [OCPBUGS-80538](https://issues.redhat.com/browse/OCPBUGS-80538): Bump google.golang.org/grpc to 1.64.1-sec.1 patch [#44](https://github.com/openshift/azure-kubernetes-kms/pull/44)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/b381b8484ed76f9fba0ac993bc03d216e11c254c...1d6fb8798544b0d0ff60582f82f885e5a6a776ba)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/006a3edb4eec250bc414da316d912fc5231d195b)

* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Add configuration override for X-SSL strip [#1472](https://github.com/openshift/cluster-ingress-operator/pull/1472)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/d14c13be1685e74b898b93a3fa7e03e9b75aa174...006a3edb4eec250bc414da316d912fc5231d195b)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/00259384502230d2c5b463dcda8a5c05caf2154e)

* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): scc: Grant authenticated users use of restricted-v3 [#1950](https://github.com/openshift/cluster-kube-apiserver-operator/pull/1950)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/aa9bd6a74ac8b3c9918581b5e49f8e7cf0109862...00259384502230d2c5b463dcda8a5c05caf2154e)


### [console](https://github.com/openshift/console/tree/5542b01c6a4bf138b1f055436bd685846df49340)

* [OCPBUGS-79455](https://issues.redhat.com/browse/OCPBUGS-79455): Bump immutable [#16323](https://github.com/openshift/console/pull/16323)
* [Full changelog](https://github.com/openshift/console/compare/f02ca58a2c598fafa277fbba7f632bae7afea4fd...5542b01c6a4bf138b1f055436bd685846df49340)


### [haproxy-router](https://github.com/openshift/router/tree/40c34581a02ca043d454034e376771c12d2e995c)

* [OCPBUGS-86717](https://issues.redhat.com/browse/OCPBUGS-86717): Strip X-SSL-* headers for plain HTTP [#797](https://github.com/openshift/router/pull/797)
* [OCPBUGS-87220](https://issues.redhat.com/browse/OCPBUGS-87220): Replace HTTP backend liveness check with admin socket check [#789](https://github.com/openshift/router/pull/789)
* [Full changelog](https://github.com/openshift/router/compare/cdfa172b2373257fdca5b8e7546378a2e762411c...40c34581a02ca043d454034e376771c12d2e995c)


### [hypershift](https://github.com/openshift/hypershift/tree/f8eff30f6d6a353da6ea9d1e581afb82d5ce57b6)

* [OCPBUGS-77967](https://issues.redhat.com/browse/OCPBUGS-77967): fix: global-pull-secret-syncer pod ~15-minute delay scheduling on new nodes [#8716](https://github.com/openshift/hypershift/pull/8716)
* [OCPBUGS-86780](https://issues.redhat.com/browse/OCPBUGS-86780): [release-4.20] OCPBUGS-81671: Ignition generalize image download errors [#8573](https://github.com/openshift/hypershift/pull/8573)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Add KAS readiness sidecar to OAS, OAuth API Server, and OLM packageserver [#8529](https://github.com/openshift/hypershift/pull/8529)
* [OCPBUGS-85825](https://issues.redhat.com/browse/OCPBUGS-85825): [release-4.20] Set unhealthyPodEvictionPolicy to AlwaysAllow on all PDBs [#8528](https://github.com/openshift/hypershift/pull/8528)
* [Full changelog](https://github.com/openshift/hypershift/compare/6a78b42be85d0d1f9f2c7fc3bf8320fd1d1bc2d3...f8eff30f6d6a353da6ea9d1e581afb82d5ce57b6)


### [insights-operator](https://github.com/openshift/insights-operator/tree/4186296303bbe4cf3f276dedf794a69a0723f18b)

* [OCPBUGS-87870](https://issues.redhat.com/browse/OCPBUGS-87870): extractor controller [#1304](https://github.com/openshift/insights-operator/pull/1304)
* [Full changelog](https://github.com/openshift/insights-operator/compare/e2549a52f29ae3365d14a9939cc135adfe0b0372...4186296303bbe4cf3f276dedf794a69a0723f18b)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/d0d6ce62b4b7ba63529b9e400cf8ec72fa4589a6)

* [OCPBUGS-86864](https://issues.redhat.com/browse/OCPBUGS-86864): Verify extension packages are installed [#6114](https://github.com/openshift/machine-config-operator/pull/6114)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/1bee530c4d08401d07454a259a5ee430edb5216b...d0d6ce62b4b7ba63529b9e400cf8ec72fa4589a6)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/5099b7a44ecd77b95c1cea215797c48b7a3e913d)

* [OCPBUGS-88372](https://issues.redhat.com/browse/OCPBUGS-88372), [OCPBUGS-88383](https://issues.redhat.com/browse/OCPBUGS-88383), [OCPBUGS-88392](https://issues.redhat.com/browse/OCPBUGS-88392), [OCPBUGS-88428](https://issues.redhat.com/browse/OCPBUGS-88428), [OCPBUGS-88430](https://issues.redhat.com/browse/OCPBUGS-88430), [OCPBUGS-88446](https://issues.redhat.com/browse/OCPBUGS-88446): CVE-2026-44487 bump axios to 1.16.0 [#1000](https://github.com/openshift/monitoring-plugin/pull/1000)
* [OCPBUGS-84289](https://issues.redhat.com/browse/OCPBUGS-84289): bump follow-redirects to 1.16.0 [#986](https://github.com/openshift/monitoring-plugin/pull/986)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/8e62a3b707c4ebccd974810f977b37286e9ba043...5099b7a44ecd77b95c1cea215797c48b7a3e913d)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/9b186403c88394b54ab491871a158a124df39a02)

* Fix for OCPBUGS-81937: CVE-2026-34986 github.com/go-jose/go-jose/v4 [#1427](https://github.com/openshift/oc-mirror/pull/1427)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/aaa36d6ba97b65a0b7a83f246ecf4bff70b938d1...9b186403c88394b54ab491871a158a124df39a02)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/eda815e0515550890354dda41e65f8dd35e15ad5)

* [OCPBUGS-82867](https://issues.redhat.com/browse/OCPBUGS-82867): Address CVE-2026-35469 [#652](https://github.com/openshift/openshift-apiserver/pull/652)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/34cb4762e1716c1a31a344118b8a3ad00c28d831...eda815e0515550890354dda41e65f8dd35e15ad5)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/e02cc75645fbc8981239e4144da1cd4dd98b1b17)

* [OCPBUGS-85366](https://issues.redhat.com/browse/OCPBUGS-85366): ANP-Skip redundant status updates to reduce API server load [#3183](https://github.com/openshift/ovn-kubernetes/pull/3183)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/24316b97b964e7de7aa2d7272aa8adc963ea9679...e02cc75645fbc8981239e4144da1cd4dd98b1b17)


### [tests](https://github.com/openshift/origin/tree/53118e346434dcf090c1c350564c194a59a571b1)

* [OCPBUGS-87902](https://issues.redhat.com/browse/OCPBUGS-87902): tests: authorization/rbac: Align restricted-v3 rule [#31285](https://github.com/openshift/origin/pull/31285)
* [Full changelog](https://github.com/openshift/origin/compare/0d4dc5038f9b63feb8cd3bd4c25676ba8cd2f433...53118e346434dcf090c1c350564c194a59a571b1)