# 5.0.0-okd-scos.0

Created: 2026-09-17 08:00:35 +0000 UTC

Image Digest: `sha256:eca01dee0f0690a8149d58f0a8c7e3187f624d583c1b713dc660bd1b28c2dfbc`

Promoted from registry.ci.openshift.org/origin/release-scos:5.0.0-0.okd-scos-nightly-2026-09-16-204152


## Changes from 5.0.0-okd-scos.ec.10

### Components

* Kubectl 1.36.2
* Kubernetes 1.36.3
* Kubernetes Tests 1.36.2
* CentOS Stream CoreOS 10 10.0.20260819-0


### Rebuilt images without code change

* [baremetal-installer](https://github.com/openshift/installer) git [b6f11977](https://github.com/openshift/installer/commit/b6f119779c7ce529a94c7b8956a057343675f212) `sha256:8f01a2d18f47fc42a32f7b3fa23b31713ded7610bb4b20c5bfe825d2057d4322`
* [haproxy-router](https://github.com/openshift/router) git [33812291](https://github.com/openshift/router/commit/3381229146657d2e6bd94115dda0885f25cb3bed) `sha256:3b780cf2f6350358655e1a9c5493d6c1f3f2ea806cc9af71d984b03abbabae6d`
* [haproxy-router-haproxy28](https://github.com/openshift/router) git [33812291](https://github.com/openshift/router/commit/3381229146657d2e6bd94115dda0885f25cb3bed) `sha256:7572c0892ad921b55236e7bd9132b3196b8b94423873a287c9861b31bcb44e01`
* [haproxy-router-haproxy32](https://github.com/openshift/router) git [33812291](https://github.com/openshift/router/commit/3381229146657d2e6bd94115dda0885f25cb3bed) `sha256:7c469e2c4fb8a6b3ab86088f7e4720df542e222c34645506482a1ee8ed6bcddd`
* [installer](https://github.com/openshift/installer) git [b6f11977](https://github.com/openshift/installer/commit/b6f119779c7ce529a94c7b8956a057343675f212) `sha256:b2e38e67783da8ace70db6f2f1e7133dde6239f662d1e19af8508ee6c871d81c`
* [installer-artifacts](https://github.com/openshift/installer) git [b6f11977](https://github.com/openshift/installer/commit/b6f119779c7ce529a94c7b8956a057343675f212) `sha256:2ea1a06653d4dd63d1d2d5c99440ad4bce7bf41ebb8b41e18aa5e587572d6cbc`


### [agent-installer-ui](https://github.com/openshift-assisted/assisted-installer-ui/tree/d085665f508757802bb8686c3dd39a8f1088fc06)

* [OCPBUGS-121378](https://issues.redhat.com/browse/OCPBUGS-121378): Do not show IRI custom manifests in the disconnected UI (#4048) (#4053) [#4048](https://github.com/openshift-assisted/assisted-installer-ui/pull/4048)
* Remove stale OCM_REFRESH_TOKEN code (#4024) [#4024](https://github.com/openshift-assisted/assisted-installer-ui/pull/4024)
* [Full changelog](https://github.com/openshift-assisted/assisted-installer-ui/compare/e46bd4d04173f9ce7c76dc1afe73e8c3ebcb608a...d085665f508757802bb8686c3dd39a8f1088fc06)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/95f0a12ce3f7f3770d099d3610a376f06cc713df)

* [OCPBUGS-122326](https://issues.redhat.com/browse/OCPBUGS-122326): skip public ip check for azure stack [#216](https://github.com/openshift/cloud-provider-azure/pull/216)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/b99e4ce4ff5c2665b273384b0673824833c40ce5...95f0a12ce3f7f3770d099d3610a376f06cc713df)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/d7957265fdafbbb93bb2a0d4723fc9719da1378d)

* [OCPBUGS-123600](https://issues.redhat.com/browse/OCPBUGS-123600): Add bmo_validations and ncsi_reject_poweroff OTE test [#657](https://github.com/openshift/cluster-baremetal-operator/pull/657)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/402bb6ef1e5cc450cd72282ed891102510b5388c...d7957265fdafbbb93bb2a0d4723fc9719da1378d)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/fb6ecceb7232511baa7df34d38e65415de52322d)

* [OCPBUGS-121354](https://issues.redhat.com/browse/OCPBUGS-121354): feat: add cert-watcher DaemonSet to restart etcd on CA bundle rotation [#1702](https://github.com/openshift/cluster-etcd-operator/pull/1702)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/a921cfeac38e9c34f8f781c812753c167679ddab...fb6ecceb7232511baa7df34d38e65415de52322d)


### [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator/tree/b6d3329d7059adba44dd0c3e9c0e9da264f9a551)

* [OCPBUGS-121350](https://issues.redhat.com/browse/OCPBUGS-121350): imageconfig: Preserve ImageStreamImportMode during upgrade race [#1367](https://github.com/openshift/cluster-image-registry-operator/pull/1367)
* [OCPBUGS-100042](https://issues.redhat.com/browse/OCPBUGS-100042): Updating ose-cluster-image-registry-operator-container image to be consistent with ART for 5.0 [#1359](https://github.com/openshift/cluster-image-registry-operator/pull/1359)
* [Full changelog](https://github.com/openshift/cluster-image-registry-operator/compare/94cd22d000c8b8eef24dd43cd05d06544df24930...b6d3329d7059adba44dd0c3e9c0e9da264f9a551)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/fdcaa390404f62f77bf2d0df0d0cd6da2f2b797d)

* [OCPBUGS-111832](https://issues.redhat.com/browse/OCPBUGS-111832): Updating ose-cluster-kube-controller-manager-operator-container image to be consistent with ART for 5.0 [#954](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/954)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/7be80f36a759d713170588c44fcd5b45970382d5...fdcaa390404f62f77bf2d0df0d0cd6da2f2b797d)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/3b484353063fe95156373f7cf51c5ba13f501256)

* [OCPBUGS-115428](https://issues.redhat.com/browse/OCPBUGS-115428): Adds rendering of enable-multi-network-policy in ovnkube-node [#3149](https://github.com/openshift/cluster-network-operator/pull/3149)
* [OCPBUGS-107980](https://issues.redhat.com/browse/OCPBUGS-107980): CVE-2026-41178 - bump go.opentelemetry.io/otel to v1.44.0 [#3133](https://github.com/openshift/cluster-network-operator/pull/3133)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/1b9a053663d46a789d8c500314cdfae3f879c060...3b484353063fe95156373f7cf51c5ba13f501256)


### [console](https://github.com/openshift/console/tree/e15ec744673924852b341bb517d605c6c6989413)

* [OCPBUGS-120694](https://issues.redhat.com/browse/OCPBUGS-120694): Installed Operators page fails with catalogsources "forbidden ... at the cluster scope" error [#17142](https://github.com/openshift/console/pull/17142)
* [OCPBUGS-121974](https://issues.redhat.com/browse/OCPBUGS-121974): Migrate OLM Cypress tests to Playwright [#17149](https://github.com/openshift/console/pull/17149)
* [OCPBUGS-120712](https://issues.redhat.com/browse/OCPBUGS-120712): Update stale comment [#17143](https://github.com/openshift/console/pull/17143)
* [OCPBUGS-115209](https://issues.redhat.com/browse/OCPBUGS-115209): Fix webhook creation in Git for PAC [#17123](https://github.com/openshift/console/pull/17123)
* [OCPBUGS-120668](https://issues.redhat.com/browse/OCPBUGS-120668): improve playwright reliability [#17138](https://github.com/openshift/console/pull/17138)
* [Full changelog](https://github.com/openshift/console/compare/d51eacd73d7c6bd722c4af36928f09c329d4d220...e15ec744673924852b341bb517d605c6c6989413)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/cab57d511106916bba6953977106f06b2fec01fd)

* [OCPBUGS-107993](https://issues.redhat.com/browse/OCPBUGS-107993): Bump go.opentelemetry.io/otel to v1.44.0 to address CVE-2026-41178 [#95](https://github.com/openshift/csi-livenessprobe/pull/95)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/463dc553ebb04df192d573c5a1612dcb50cb1f52...cab57d511106916bba6953977106f06b2fec01fd)


### [docker-builder](https://github.com/openshift/builder/tree/1e53243554dead3d84297e341651c5eb83eb37a4)

* [OCPBUGS-95492](https://issues.redhat.com/browse/OCPBUGS-95492), [OCPBUGS-98108](https://issues.redhat.com/browse/OCPBUGS-98108): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#550](https://github.com/openshift/builder/pull/550)
* [Full changelog](https://github.com/openshift/builder/compare/35b0a13b45e95c19046a59dc8727cf60210d6a0d...1e53243554dead3d84297e341651c5eb83eb37a4)


### [hyperkube, installer-kube-apiserver-artifacts, kube-proxy, pod](https://github.com/openshift/kubernetes/tree/b376ee7b841bed5a51cb9520b37d87931c48a821)

* [OCPBUGS-108014](https://issues.redhat.com/browse/OCPBUGS-108014): UPSTREAM: <carry>: bump otel to v1.44.0 to fix CVE-2026-41178 [#2762](https://github.com/openshift/kubernetes/pull/2762)
* [Full changelog](https://github.com/openshift/kubernetes/compare/306002d4cb7d5621b4b9d1871d1d029682f8f824...b376ee7b841bed5a51cb9520b37d87931c48a821)


### [hypershift](https://github.com/openshift/hypershift/tree/93cce984163b400abfde05b67a0b7d5f3f589d4e)

* [OCPBUGS-123146](https://issues.redhat.com/browse/OCPBUGS-123146): Updating ose-hypershift-container image to be consistent with ART for 5.0 [#9597](https://github.com/openshift/hypershift/pull/9597)
* [OCPBUGS-117010](https://issues.redhat.com/browse/OCPBUGS-117010): preserve immutable AWS load balancer annotations [#9489](https://github.com/openshift/hypershift/pull/9489)
* [OCPBUGS-114435](https://issues.redhat.com/browse/OCPBUGS-114435): fix(konnectivity): enable --sync-forever to restore lost agent-server tunnels [#9430](https://github.com/openshift/hypershift/pull/9430)
* [OCPBUGS-113998](https://issues.redhat.com/browse/OCPBUGS-113998): fix(azure): skip KMS validation for private Key Vaults on ARO HCP [#9405](https://github.com/openshift/hypershift/pull/9405)
* [OCPBUGS-115188](https://issues.redhat.com/browse/OCPBUGS-115188), [OCPBUGS-121650](https://issues.redhat.com/browse/OCPBUGS-121650): backport safe-to-evict annotation and operator health probes fixes [#9534](https://github.com/openshift/hypershift/pull/9534)
* [OCPBUGS-98883](https://issues.redhat.com/browse/OCPBUGS-98883), [OCPBUGS-98887](https://issues.redhat.com/browse/OCPBUGS-98887): bump haproxy to 3.0.5-6.el10_2.2 for CVE fix [#9336](https://github.com/openshift/hypershift/pull/9336)
* [Full changelog](https://github.com/openshift/hypershift/compare/7a5170972d2ec1aea5f049b3c8351de9ac1f009d...93cce984163b400abfde05b67a0b7d5f3f589d4e)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/3604a6c42f3002800e5cad2a012aacaf9b5f7405)

* [OCPBUGS-108009](https://issues.redhat.com/browse/OCPBUGS-108009): UPSTREAM: 2933: Bump all go.opentelemetry.io/otel modules to v1.44.0 [#186](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/186)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/286dd2de7957e9c2897e152417f16907d324d819...3604a6c42f3002800e5cad2a012aacaf9b5f7405)


### [ironic](https://github.com/openshift/ironic-image/tree/1b55b61973edd01938783aa2c3cc22c9ea97dfa6)

* NO-ISSUE: Update requirements.cachito with latest openshift forks commits [#897](https://github.com/openshift/ironic-image/pull/897)
* [Full changelog](https://github.com/openshift/ironic-image/compare/001adec7884e75a5078e4e72c8bc8d2a51376b43...1b55b61973edd01938783aa2c3cc22c9ea97dfa6)


### [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator/tree/05d6b0c4537954b2b115c793646fb598756bb303)

* [OCPBUGS-87255](https://issues.redhat.com/browse/OCPBUGS-87255): Updating ose-kube-storage-version-migrator-container image to be consistent with ART for 5.0 [#243](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/243)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#260](https://github.com/openshift/kubernetes-kube-storage-version-migrator/pull/260)
* [Full changelog](https://github.com/openshift/kubernetes-kube-storage-version-migrator/compare/72835e43c7754356645e41031f3a99926b4d42e6...05d6b0c4537954b2b115c793646fb598756bb303)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/ec5cb6c3bcd7448f2b757ab951eafd2c46d677b9)

* [OCPBUGS-114854](https://issues.redhat.com/browse/OCPBUGS-114854): CVE-2026-15792 openshift4/ose-machine-config-rhel9-operator: BuildKit: Denial of Service via malicious client request [openshift-5.0] [#6519](https://github.com/openshift/machine-config-operator/pull/6519)
* [OCPBUGS-122284](https://issues.redhat.com/browse/OCPBUGS-122284): updateLayeredOS deploy-from-self when skopeo < 1.22.2 [#6534](https://github.com/openshift/machine-config-operator/pull/6534)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/f81aa9cf1d4bb4999a300f0df364f8685fd65d10...ec5cb6c3bcd7448f2b757ab951eafd2c46d677b9)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/97c9a8384e5d7fe92d9b1bc4dc8c676b6bc78eff)

* [OCPBUGS-114748](https://issues.redhat.com/browse/OCPBUGS-114748): [release-5.0] DOMPurify: Cross-Site Scripting via IN_PLACE sanitization [#1265](https://github.com/openshift/monitoring-plugin/pull/1265)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/ead9ddbe0f08c13ba813004e31506de40586313e...97c9a8384e5d7fe92d9b1bc4dc8c676b6bc78eff)


### [must-gather](https://github.com/openshift/must-gather/tree/f4c72a69ebedddead25591da3a115bc4b0bc49ca)

* [OCPBUGS-123521](https://issues.redhat.com/browse/OCPBUGS-123521): Add windows_exporter log collection [#566](https://github.com/openshift/must-gather/pull/566)
* [OCPBUGS-122387](https://issues.redhat.com/browse/OCPBUGS-122387): Update build-machinery-go vendor dependency [#564](https://github.com/openshift/must-gather/pull/564)
* [Full changelog](https://github.com/openshift/must-gather/compare/a0ede0ebb91084ab103f8c8921aea5a7a04b73bb...f4c72a69ebedddead25591da3a115bc4b0bc49ca)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/4509d691e67664e9b3a911278fcbf38d54bb9cfc)

* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Remove unused Dockerfile.art [#517](https://github.com/openshift/networking-console-plugin/pull/517)
* [OCPNETUI-78](https://issues.redhat.com/browse/OCPNETUI-78): Sync Dockerfile and Dockerfile.art [#495](https://github.com/openshift/networking-console-plugin/pull/495)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/f1b85458ebe27eb262e1750bd59de67986f84111...4509d691e67664e9b3a911278fcbf38d54bb9cfc)


### [stream-coreos, stream-coreos-extensions](https://github.com/openshift/os/tree/7324ccd30e5b2b3146639cb610bfe92c743c91a1)

* [OCPBUGS-115309](https://issues.redhat.com/browse/OCPBUGS-115309): Re-enable sandboxed-containers extension for 5.0 [#1965](https://github.com/openshift/os/pull/1965)
* [Full changelog](https://github.com/openshift/os/compare/d2f3751e77c4b79b1553d18758c2ea91f06f51fc...7324ccd30e5b2b3146639cb610bfe92c743c91a1)


### [tests](https://github.com/openshift/origin/tree/83ec78e3c4eece275f65229c420b211a427edde3)

* Revert "OCPBUGS-83412: monitortests: skip PodSecurityViolation invariant when OpenShiftPodSecurityAdmission is disabled" [#31604](https://github.com/openshift/origin/pull/31604)
* [OKD-454](https://issues.redhat.com/browse/OKD-454): [release-5.0] Skip OKD job name check for cluster-bot launch jobs [#31629](https://github.com/openshift/origin/pull/31629)
* [Full changelog](https://github.com/openshift/origin/compare/d829b900b99e4d9afc163b14be91a385ed7ea705...83ec78e3c4eece275f65229c420b211a427edde3)