NO-JIRA: Update registry.redhat.io/openshift4/ose-must-gather-rhel9:v4.20 Docker digest to 290c700 [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-must-gather-rhel9	final	digest	b3ff890 → 290c700

---

tar: node-tar: Denial of Service via crafted long-path tar archive

CVE-2026-73566

More information

Details

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the filesFilter function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73566
• https://bugzilla.redhat.com/show_bug.cgi?id=2515509
• https://www.cve.org/CVERecord?id=CVE-2026-73566
• https://nvd.nist.gov/vuln/detail/CVE-2026-73566
• https://github.com/isaacs/node-tar/commit/631ae59121bf8fc8a22bbae35f074cb9b789cd4a
• https://github.com/isaacs/node-tar/security/advisories/GHSA-r292-9mhp-454m

---

nanoid: nanoid: Predictable ID generation due to integer overflow

CVE-2026-73086

More information

Details

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoid(size) function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73086
• https://bugzilla.redhat.com/show_bug.cgi?id=2514175
• https://www.cve.org/CVERecord?id=CVE-2026-73086
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci-robot]

@red-hat-konflux[bot]: This pull request explicitly references no jira issue.

Details

In response to this:

This PR contains the following updates:

Package	Type	Update	Change
registry.redhat.io/openshift4/ose-must-gather-rhel9	final	digest	b3ff890 → b9fd63c

---

nanoid: nanoid: Predictable ID generation due to integer overflow

CVE-2026-73086

More information

Details

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoid(size) function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-73086
• https://bugzilla.redhat.com/show_bug.cgi?id=2514175
• https://www.cve.org/CVERecord?id=CVE-2026-73086
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

---

Configuration

📅 Schedule: (UTC)

• Branch creation
• At any time (no schedule defined)
• Automerge
• At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8799338f-dddd-497a-aa3b-2c5cd1fa22f2

📥 Commits

Reviewing files that changed from the base of the PR and between 959f8e7 and 7ac54c2.

📒 Files selected for processing (1)

• release/must-gather/must-gather.konflux.Dockerfile

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

Walkthrough

The must-gather Dockerfile now uses a new SHA256 digest for the ose-must-gather-rhel9:v4.20 base image.

Changes

Must-gather image update

Layer / File(s)	Summary
Update must-gather image digest release/must-gather/must-gather.konflux.Dockerfile	The Dockerfile updates the pinned digest for the ose-must-gather-rhel9:v4.20 image.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 7ac54

This PR updates a single container image digest to incorporate dependency security fixes, with no actionable merge-blocking risk remaining beyond normal checks and review.

Suggested labels: ready-for-human-review

Suggested reviewers: jaypoulz, jeff-roche

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the image digest update and indicates the security purpose. It matches the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The verified diff contains no Ginkgo test files or test-title declarations, so…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only one line in release/must-gather/must-gather.konflux.Dockerfile, replacing the base image digest. It does not add or modify Ginkgo tests, test setup, cleanup, wait…
Microshift Test Compatibility	✅ Passed	PASS — The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile (1 insertion and 1 deletion). It adds no Ginkgo e2e tests or test references, …
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request changes only the FROM image digest in release/must-gather/must-gather.konflux.Dockerfile. The HEAD^..HEAD diff contains no Ginkgo tests or other test files. Therefore, it…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only the base-image digest in release/must-gather/must-gather.konflux.Dockerfile. It does not add or modify deployment manifests, operator code, controllers, replica s…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes only the pinned FROM digest in release/must-gather/must-gather.konflux.Dockerfile. It adds no fmt, log, klog, Ginkgo setup, or OTE process-level stdout write. …
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The commit adds no Ginkgo e2e tests and introduces no IPv4 assumptions or ext…
No-Weak-Crypto	✅ Passed	PASS: The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography…
Container-Privileges	✅ Passed	PASS: The pull request changes only the base image digest in one Dockerfile. It does not add privileged settings, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation. The Dockerfile …
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The commit changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. It adds no logging commands or sensitive-data handling. The Dockerfile contains no p…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS: The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The verified diff contains no Ginkgo test files or test-title declarations, so it introduces no unstable test name.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only one line in release/must-gather/must-gather.konflux.Dockerfile, replacing the base image digest. It does not add or modify Ginkgo tests, test setup, cleanup, waits, or assertions. The custom check is therefore not applicable.

Full details: Microshift Test Compatibility

Explanation

PASS — The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile (1 insertion and 1 deletion). It adds no Ginkgo e2e tests or test references, so the MicroShift test compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request changes only the FROM image digest in release/must-gather/must-gather.konflux.Dockerfile. The HEAD^..HEAD diff contains no Ginkgo tests or other test files. Therefore, it introduces no SNO multi-node assumption under this check.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only the base-image digest in release/must-gather/must-gather.konflux.Dockerfile. It does not add or modify deployment manifests, operator code, controllers, replica settings, affinity, topology spread constraints, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes only the pinned FROM digest in release/must-gather/must-gather.konflux.Dockerfile. It adds no fmt, log, klog, Ginkgo setup, or OTE process-level stdout write. The image entrypoint remains /usr/bin/gather, and the repository diff contains no changed OTE binary or suite setup code.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS — The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The commit adds no Ginkgo e2e tests and introduces no IPv4 assumptions or external connectivity requirements.

Full details: No-Weak-Crypto

Explanation

PASS: The pull request changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret-comparison code. The copied collection scripts also contain no flagged primitives or comparisons.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only the base image digest in one Dockerfile. It does not add privileged settings, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation. The Dockerfile sets USER 65532:65532, so it does not run as root without justification.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS: The commit changes only the pinned base-image digest in release/must-gather/must-gather.konflux.Dockerfile. It adds no logging commands or sensitive-data handling. The Dockerfile contains no password, token, API-key, PII, hostname, or customer-data logging changes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch konflux/mintmaker/main/docker-registry.redhat.io-openshift4-ose-must-gather-rhel9-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign pacevedom for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@red-hat-konflux[bot]: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.