RHSA-2026:90317HighCVSS 9.1

Red Hat Security Advisory: LVMS 4.13 Bug Fix and Enhancement update

Published
October 26, 2026
Last Modified
November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products14

  • Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:4011014919d90558be81efe56a7f11c444ac3c3269f1e2482d0bb424dd9f0ec8_ppc64le as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:583f685a3cd2f79265a6990a3fc0c3c88549ff58bb247b364d2a4bffc2a8b313_amd64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:8334e0cd5f1992cef327b6acd3ee6fb4f0a1168df4b6237020dea0050bb5ee29_arm64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:90003abb17cb547fb5bb63408b5246c66e3a9e723a068b0452172ad5c1eb63c2_s390x as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-operator-bundle@sha256:9615bd629e76e44b472e495d3c35ed97705ec3a74107b323a43fd45348d48ba5_amd64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:609cf8f58b0a9cdcf3fbcedec5b723dc735f3cae4c4e30a3149117b46dc0e8b0_ppc64le as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:afb4a295519e5e971f558d0298c5b10130ad83c170bdc25dacf7566bdb94977d_arm64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:d93ba497e6d07c45220dc01f2df440b76889e7e66b5aef55bb56673396b7f18b_s390x as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:e40421668ab17e36c054477bc25274d4e4d3b4c300c8bf063170e61421e0ff1f_amd64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/topolvm-rhel8@sha256:58f9a95e70610f95b9b78f4e1a61df151c29c5b10efb39a9181962bfb7983f0a_ppc64le as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/topolvm-rhel8@sha256:8e737f1e975fc7a521e4845a37fd3eb99b491a67b7b463a20bbec5699e1c3958_s390x as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/topolvm-rhel8@sha256:b0378e7c5618084d8f623b85435d61c2f37d25414732e5604a4d7ce1a00f053d_amd64 as a component of Logical Volume Manager Storage 4.13
  • registry.redhat.io/lvms4/topolvm-rhel8@sha256:c27733b9ae1f8ff58bd6ea67ffda521fc24c4c367e713485b3d7ab52b2095d55_arm64 as a component of Logical Volume Manager Storage 4.13

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)