RHSA-2026:12277HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.10 security, enhancement & bug fix update

Published
April 30, 2026
Last Modified
August 21, 2026

🔗 CVE IDs covered (5)

CVE-2026-4800 →CVE-2026-27942 →CVE-2026-33036 →CVE-2026-33186 →CVE-2026-34986 →

📋 Description

CVE-2026-4800 — lodash: lodash: Arbitrary code execution via untrusted input in template imports CVE-2026-27942 — fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service CVE-2026-33036 — fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products103

  • Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:f399b7669f82d8c7261202abec0cbfd3b2fac76709a70fb2a513b4b11fade258_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:2cebd0dc24a731f2c2d33a7b1930d9bf65845ab83817775d378c07630a1e55c1_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:54beb2645e89c0ad54c9d454cf9976bbdbe8d39f7de7087a99d7a5a0fa8db535_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:b16e684d89de40f241e55d95da5f4fccc66822a660e5acd3be981b71b5057702_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:f9b729a5ea810214412e82fab3bfe36602f6cba9a07e6eb0bc2032c5dc556e17_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:1838b85d294f260d3cbbcdeabb19bcd0c3fb1f0ce31c5676dfa48b10ad8d59b7_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:6dbbc46f47994ad8bcf29f040b64a9b9c17c161ba9babfea3ce1c8a15fec32af_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:db57ed5bd968276e033a68a90f369dd41708dc6404db38c1d9b2a07a8327499a_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:dfdf81ab0ca1b4c8155b8b37db728aa37c3b708e8621995da9cbd576086954c3_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:411aa11f920b73eb4cdf4afa7948e5e3bd161e4f8068b8349025368ee0806013_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:5516d05155406fa1183a4f913d420ec8c382b6aeeba2c69c0184dbdf78e95eb1_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:7248ed40e12d7fb5881f9d76aa01ea43a3095c9ecac5854303f732043ada3917_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:ea7c225e4acb2eec25cb48e6068c08ae077beee67458ae58e3465851940fd81d_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:bfaf01516833acaf30eb30165f66687f122fa5fa5a66d87ff623a5c9eda9faf3_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:1ed70f06ed113964103868d57e983e06f1473500040d2d6c0a5bd27e2385bf7f_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:326f6201fe88992855a8f945f4c40f62d1a2e8fb83c38cb77b769b2889627f4e_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:40b71d0ac98a372943219f0a138dc08d7f4e6d3c4337e0787463f86b4bb28c07_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:d0645cfddaf15cbb47ea1755ea118e607f11b4f32ab3fb4f87c53b52de7bbcdd_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:459ee750a0ab1209540ad9c09b090beffd5da246aeb7171993c7812652cfd82e_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:8427b24d33a5f1c51e1314194be758c501be31b0b5ec53f256871a0d8dc82621_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:cbdb7a6550b3723f7dfcf5abfae878860c6101df8a6429a596c5a0c58486c3bd_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:dfc04028f84b17339c8950c890bd27f55169e3aa60b9555fea15f2c2cb720c1b_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:d9dfc4f0b824dc259a0b53d143446a67a9356dc28cfd78e3e3ed452b24b98e5f_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:6bcaee8923f89346dad8e9830cf17e115c86668525f644d11fbaf9608b4df9fc_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:dbf5873f3b7025e31a09a502da82a0c2a49ffd636c2f1186a418b1b327c3e30f_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:e6fc86165dcd9f9239f11d7792cf51e84275091b7864c7b3cb24f23a33f5aa2c_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:f567517ba81297b4be348c9fe9960d14b758ae2fb7b0c7d38389b05bc445f86b_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:55c1db11abb65030a27ace0692b24ac91d591fe7279cc699647bb7e47377ee46_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:6df05909b32cea6072f7e93f62ea6092dd6644505b7c377a41b7eafddd98e957_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.20/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, configure applications using the `fast-xml-parser` XML builder to set the `preserveOrder` option to `false`. Alternatively, ensure that all XML input data is thoroughly validated before being passed to the builder to prevent the processing of malicious or malformed content. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (9)