Which 4.y.z to 4.y'.z' updates increase vulnerability?

Any 4.18 to 4.19.[0-3]

Which types of clusters?

HCP hosted clusters with MetalLB operator installed

What is the impact? Is it serious enough to warrant removing update recommendations?

Cluster Network Operator (CNO) fails to deploy a critical component (FRR-k8s) when updated to an affected version and MetalLB will stop working properly and stop advertising services, making them potentially unreachable from outside the cluster.

How involved is remediation?

No known remediation

Is this a regression?

Yes