RHSA-2026:37387HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update

Published
July 9, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (51)

CVE-2026-39834 →CVE-2026-33814 →CVE-2026-35172 →CVE-2025-52881 →CVE-2025-54410 →CVE-2025-58058 →CVE-2026-22772 →CVE-2026-23831 →CVE-2026-33540 →CVE-2024-40635 →CVE-2025-66506 →CVE-2026-25680 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-39832 →CVE-2026-39833 →CVE-2026-41506 →CVE-2025-47911 →CVE-2026-39830 →CVE-2026-41567 →CVE-2026-42502 →CVE-2026-44740 →CVE-2026-45571 →CVE-2026-46595 →CVE-2025-21613 →CVE-2026-24117 →CVE-2026-33748 →CVE-2026-39827 →CVE-2026-39831 →CVE-2026-41568 →CVE-2026-42508 →CVE-2025-8766 →CVE-2025-22870 →CVE-2026-27141 →CVE-2026-39829 →CVE-2026-39835 →CVE-2024-25621 →CVE-2025-21614 →CVE-2026-39828 →CVE-2026-46597 →CVE-2025-64329 →CVE-2026-25934 →CVE-2026-34986 →CVE-2026-39883 →CVE-2026-42506 →CVE-2026-46598 →CVE-2024-45310 →CVE-2026-27903 →CVE-2026-33747 →CVE-2026-35469 →CVE-2026-39821 →

📋 Description

CVE-2024-25621 — github.com/containerd/containerd: containerd local privilege escalation CVE-2024-40635 — containerd: containerd has an integer overflow in User ID handling CVE-2024-45310 — runc: runc can be tricked into creating empty files/directories on host CVE-2025-8766 — noobaa-core: Excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container CVE-2025-21613 — go-git: argument injection via the URL field CVE-2025-21614 — go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies CVE-2025-22870 — golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net CVE-2025-47911 — golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html CVE-2025-52881 — runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects CVE-2025-54410 — github.com/moby/moby: Moby's Firewalld reload removes bridge network isolation CVE-2025-58058 — github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory CVE-2025-64329 — github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaks CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-22772 — fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation CVE-2026-23831 — github.com/sigstore/rekor: Rekor denial of service CVE-2026-24117 — github.com/sigstore/rekor: Rekor Server-Side Request Forgery (SSRF) CVE-2026-25680 — golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-25934 — go-git/go-git: go-git: Data integrity issue due to improper verification of pack and index files CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27141 — golang.org/x/net/http2: golang.org/x/net/http2: Denial of Service due to malformed HTTP/2 frames CVE-2026-27903 — minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns CVE-2026-33540 — github.com/distribution/distribution: Distribution: Information disclosure via improper validation of authentication realm URL CVE-2026-33747 — BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend CVE-2026-33748 — github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35172 — github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39827 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39831 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39833 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39883 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris CVE-2026-41506 — golang: github.com/go-git/go-git: go-git: Information disclosure of HTTP authentication credentials via redirects CVE-2026-41567 — docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload CVE-2026-41568 — github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-42506 — golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-44740 — github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-45571 — github.com/go-git/go-git: go-git: Path validation flaw allows unauthorized file access CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation CVE-2026-46597 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs CVE-2026-46598 — golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input

🎯 Affected products125

  • Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:0436c7a77f0639a173de3fea3420fb61629aaa5e6ec38ebce2eb3b75970e9965_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:022f660bb0be440e9d99abf8815ede618710a390d315ccc79e9812a1c0f9ae02_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:1e55fe6360f7b5bce7d4ae524235b3ed5c8af0088b90c25c85dc8fe29319e777_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:9e492330bdada69efd431ecc370e3082fdd9366d2e5a00901f1101fb71fbaea5_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:bdbd70d08ef6c7266a0a7cf0026192fffdb7c96a9bd13eec21a1046dc60ed54d_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:05df2bcbadb214e4873082f282ef013565f04f24dce406d3802288d6ad574741_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:4d2215693809fd61f6d4d81333b41739fd7e34ad87fe79f9176db69c95265acb_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:bda64b773b0cad6ac42ef57948b61ae92ab97fcf264e946f83fda183850af573_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/cephcsi-rhel9@sha256:fb187a502fe69355bf96070a3761e1800a66f6b282d1e1169bba016d9085eee6_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:0ec0bc6ad7ee67b04329e5ecd38d2875bfb32374eda4afcb3748b38c35e3b99d_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:9841e96fcd4ce5aa597e1f0055a51a75aa01d26b4c347f245b0b550e17546389_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:c1f7e2899e8cd209f08d3e7501a3dc7b8237cc4ca980792902e131df23d157ef_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/devicefinder-rhel9@sha256:e08093d4536d5d416e53344a12ddca0d11e6fe0d2ba4fdc274993ec65a375e15_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:10e9e92062c5a5f20882f2b50beff64f79f7694c381aec03c76f39000d85dada_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:2fd265900415e09d09023b1f34b6abf7c69c788112ba2d1584cd5351d02256e1_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:95e75300d8973cff3e15e02481c134fe82f04bbfcf5a7d47f3e70bc4be2afdf7_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-core-rhel9@sha256:e556c0bb72ec94a866d8377c1c6b86f8378e0600cc438dc07b5b0bc4f8fe8bec_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-operator-bundle@sha256:149034756256331268917315017d8b78d04ec12837d9aecd9ec780af3a8f4f13_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:37413dc3a5a103aa2bf7a3729015273bff19ab3cd075a0e116ec815ebddc251c_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:5e517f3a9f3aabd9309b2ae9a4845fd49ba50f68480badfecf78ae3630208b68_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:7ddedb3a461dba624cc1caf8817b7681d765ee60f50dc98ca558017e8cf258c5_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/mcg-rhel9-operator@sha256:e6db008af980445fc56ef33ae8c6cefcaf3a94b1457ccf1f2607a008769f20dc_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:60ed56e922e0080a86c8ac0a2f2200f60fdd980ab0efc66076c263c86fd2c034_arm64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:6b4232b8c2786930f181f6d4b8e8d61bec10ee6b82b02fc1275f50b79a22fa5d_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:8489175e280fa95c77348e07d7efb574e0029df03419354f6aed9788e3caaa64_ppc64le as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:a45ca870fd300495fbfeecea3e982364eec7f5f9b3886c538684c380b038025f_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:17335f3ac57331ca81b8458224351bc6983a4f785ea52f4bdd003c12a6645bd6_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:2474faddf028689bdcda3c3b39ca4a46f6f276dc00ab0dd4cc712fddde680100_s390x as a component of Red Hat Openshift Data Foundation 4.22
  • registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:4b726e545c93781a53828d42507c5aac876833409e9565b66e6c416dae35c39d_amd64 as a component of Red Hat Openshift Data Foundation 4.22
  • +95 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf Workaround: The system administrator on the host can manually chmod the directories to not have group or world accessible permissions: ``` chmod 700 /var/lib/containerd chmod 700 /run/containerd/io.containerd.grpc.v1.cri chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim ``` An alternative mitigation would be to run containerd in rootless mode. Workaround: To mitigate this vulnerability, ensure that only trusted images are used and that only trusted users have permissions to import images. To implement the recommended controls in OpenShift: 1. Restrict allowed registries at the cluster level by configuring image.config.openshift.io/cluster with allowedRegistriesForImport and registrySources.allowedRegistries. 2. To find out who can pull/import container images into OpenShift for that namespace Based on RBAC permissions: `oc adm policy who-can create imagestreamimports -n <namespace>` 3. Enforce image signature verification using sigstore or cluster image signature policies. 4. For GitOps deployments, use Gatekeeper/OPA policies to enforce that ArgoCD Applications reference only approved registries. Workaround: In cases where it is not possible to update to the latest version of go-git, it is recommended to enforce validation rules for values passed in the URL field. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Potential mitigations for this issue include: * Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective). * Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse untrusted HTML content, or enforce timeouts on HTML parsing operations. Applications that do not parse arbitrary HTML are not affected. Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: To mitigate this issue, ensure that all upstream registries configured for Distribution in pull-through cache mode are trusted and secured. Implement network segmentation and firewall rules to restrict outbound connections from the Distribution instance to only known and trusted upstream registry endpoints. This reduces the risk of an attacker-controlled upstream or a Man-in-the-Middle attack redirecting authentication. Workaround: To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use. Workaround: To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure. Workaround: Avoid using docker cp with untrusted running containers. Recommended to apply patches: Mountpoint creation is now scoped to the container root using os.Root (Go 1.24+), which refuses to follow symlinks that escape the opened root directory. All filesystem operations in createIfNotExists (MkdirAll, OpenFile) are performed through the os.Root handle, so even if a symlink swap occurs after path resolution, the creation stays confined to the container root. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: Update affected Go applications to use golang.org/x/net version 0.55.0 or later. As a workaround, do not use golang.org/x/net/html to parse and re-render untrusted HTML content. Applications that do not parse arbitrary HTML are not affected. Workaround: To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+ Workaround: To mitigate this issue, restrict the exposure of the SSH agent to untrusted sources. Avoid enabling SSH agent forwarding when connecting to untrusted hosts or environments. Ensure that applications interacting with `golang.org/x/crypto/ssh/agent` validate all inputs to prevent malformed data from being processed. Reloading or restarting SSH services may be required for changes to take effect.

🔗 References (55)