RHSA-2026:26412HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update

Published
June 16, 2026
Last Modified
September 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products103

  • Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:8c4b08caf930cd7a8cf21d8e2ec0d063a2f1cbfcdd961b696923813fb5c2a9eb_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:1b7055b6a566413234c28bd08ef5b671ce661fc4ae2bc47d6c0522c803753ee6_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:80792768165459f858c9ac9cd85f3e350ffa2afeb042c304dfbca6040c885210_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:8a1248b56b89a1f35cd0a00e9b4c435788585d5f54c40f1adfebaa493b83e251_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:91030bf768fc1485471a09fdd09e8c9c1fe4c2553b05845b15a7831b5d8de1f9_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:669118be8ae864e48be5304aae036c4ce924bfe3afef5e856d1b9a5c5ad7169c_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:7d37197086204c60611362342f7c41b14a5b2c9521f2e09e2ecbe75c8b260450_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:80db619879d5313a8a7c1e07fb12f3b2455c6a2d67bd03c0b306d60b7a1cacff_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:cf0533469ec44a71ea718d1fc78146db027b1b6660a60b5d2d01191e004bba34_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:754c4ad452d7c1e8251f2ae88de0314f97ce27ab34435efb21897036dd3156ad_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:9c8c2ce98e61432ce9ad3bee19d853779ff444a313e36bb98d926c2e9f53da9f_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:b5b2c06d13898496ee92bc89aaae0a290e2fc31b7704d578aea74940c27a05f7_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:d4ae4a86a07242dbbfdeffb9a94a4430a749674c8f57df8118e26c1a9b7c8cd6_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:abb104d0237852681cfb62b04414c09ba0b341cdeb82fd18baf583ccd8a81339_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:12d37eb38c88b5a3e29465ab9898bf85e6e9d8359f60c7eb2c2290478f336bf1_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:440fe733f3746e813d0a5aa99866defbb5c7c2ca18334298a34e65b5af7f9f64_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:7f0943cae5489ee2d939ea4d514e1c4989823eef31e050742cb46da5d21cd519_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:be57cdb735f43afc1951b46d81601d6ba417f9bd23cec4101eb2cdd6d7c1c572_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:2f512b2c2931d19194afd78b695f1eea249937a9e87c8a7b09b7e21c2586e4eb_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:496e3c065b2ff0c4279e88fc15fb50a376976f541c5db3e499e406b2d6671be8_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:b08bed76fafd960921a66aaed549fe3625359da0fc4567c57d3511b94c6cf415_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:bde1a31ce3005416750a67168f3a706bc9a8a28d7d4779a155350e00e3d4cf0b_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:fac7de90f074454918a332814e2363fe1039d1384ae72c5d8d7f49489222bc6c_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:0b04b1261c6c19db989e44602c89d59143825da6d0bf8e3726ef8c50ad78620c_arm64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:2b66265561615956d15e9761bf9923aa2a30b420db40b10b281e5f24ed4b8026_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:6dee986456c548977b074dbb4f2e0e04cbad3a56591108b2acb2e2c3f839c395_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:e37027671b9dc477aea3ed8431cfca4867c416f562268b1ff735e9aa2d39651a_s390x as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:3f0915a1139be1455faa9061436a94aaf5accc71a06d4cb188cd3eff0330f0ad_ppc64le as a component of Red Hat Openshift Data Foundation 4.20
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:b4c8f052e208ab2da1a69a54328ab4060fdaf77727bb0ede9fdfe39da94dc7af_amd64 as a component of Red Hat Openshift Data Foundation 4.20
  • +73 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.20/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (5)