RHSA-2026:26416HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update

Published
June 16, 2026
Last Modified
October 15, 2026

🔗 CVE IDs covered (2)

CVE-2026-6321 →CVE-2026-33186 →

📋 Description

CVE-2026-6321 — fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products76

  • Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:4c908b6426368804cb7694daa9f2be625cc45867748d12e657667a8f3188d7d3_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:8fa720611f9480c85a98aa02820b753375e3a2b6cf3ff48c2cccfa85f252ff9d_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:f69bcbc5bdf7272f9d6ff498d7050551eb68d90b49a62fb7b064c619b37cc629_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:b0dac1e8fc63c2dd29c896226296b516e5c2f9392262492df513e2a4e4aa52bb_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:cf532216fd16054fc33c7b89ee46b96ff41b9efc410a9934c60e65c6ed6006b2_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:eedc6c9a38e39361ae04d9b750b94a0d539d2d4507c7274dc1b3c0846269baf0_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:35dbd7464e835f16ec99e684f9de9b1a201a962f0ae1ac53e5162827dda4c4aa_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:3cf76024b99b9613a66e4d1ca8184c524ea96ed96c1ddf8c7d27f31ec29659c9_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:6a6b1c4e9b737fa2ce70779a58eeb5c6cfaa81d3cf7bb9d5ca3270082f3436dd_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:77ec395add21168ca60cd78c4b7d938d4a5c7766ce8037bfe1d6a221a38fd79b_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:d1c67a820a8f37f1e0e36ed864a3d662a7e669cc0bad90f4eb38bee924a9e375_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:6f6a208f69ed10ba8bc11ce5aeb9dffe758726c7ff6d98f4521df0ba4052203e_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:9f973b754c612e8632ca6517be654f027523b4493bcea3797e0cc15164a819d9_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:b28165a0ac6def027d1384f5453916bb2b0cb7f8afd044f202e4499805bcba0b_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:19b13d71bbc308e19ae6ceb88ebbccd5fe0cc3c701ff3af332aed334e6380e17_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:2d584a541c4d5f485278aa1b1ecf6e242a115efdcdfc8485de19770c8f392574_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:644122a3d45ee9f92d5e61865fae94774bcb8430addbb432a490f0bd1c1beffe_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:a18bce14e210c57ff36cc99bcc55fd595de761fa534e62d5d192e9a918c1ee28_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:d61e981b9427b788b01000b7fb6bfab573fe5001be835b8338cf49b85baf716d_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:0dc5a68a11bf8d4545a6c51f77634f79929c3a35eee35e853255b5cc73c0aecb_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:bae0120899ef5e5e677e76e88c7f1e9e02c16de0bd241f80036a59d190063343_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:d4aff3e1d59401026e51722e0d36147484192faf1b5cf2389901a2de062d713d_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-operator-bundle@sha256:0dbecb19f18e46b109c928bb4f94d1a680adfbc8af91f20a13717830ccb97eba_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:0d9e24a47f3ce64f30e88443ab469f797ea731f7ced30e74fbe45cd6c5dfaf98_amd64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:1f4703c4f401b1b0cd1bde4a812fd4bf398839c8bf3270ef41df7f36e8c4f073_ppc64le as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:acd1f0a6da87f3e4cc65232ed8d33b44e7863884633f5ad8acade2e2e38031ae_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/ocs-rhel9-operator@sha256:e1d678f8337d4427babca4b049f588c101f33ed90c3013feba668c831783504d_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/odf-cli-rhel9@sha256:6149b48827753a67192321e9739240485da5924022416aef62de6b59fb61a48d_s390x as a component of Red Hat Openshift Data Foundation 4.16
  • registry.redhat.io/odf4/odf-cli-rhel9@sha256:67e27737e1f7575b2e326a22cda7873793b88c35decb2525e92fa0dcc78216bb_arm64 as a component of Red Hat Openshift Data Foundation 4.16
  • +46 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.16/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (6)