RHSA-2026:90950HighCVSS 9.1

Red Hat Security Advisory: LVMS 4.15 Bug Fix and Enhancement update

Published
October 27, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-33186 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products14

  • Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:5a32e1c90afce4fce715a26287a46af4d0796c379b0999af9d07e6678790450d_s390x as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:6316533821673c23129077d0309f43d3a0f3055c06492e891fa54274a1e75dd6_ppc64le as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:737743d336778aecd5126b2c197ecc0900c6f658c6abcbc7f79604f2b7ed743b_arm64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:bf35c4c172961987405e13acb946299918fe960efca491608651603f04d226e0_amd64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-operator-bundle@sha256:2e54db56ab9c0c618328db410c45cc769771c27b227bc184df914622a37a39d9_amd64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:14d141a2cc0342eb95dc6168614aa7b7d17e8eb7ed3b49dc55b1ccf86f80cdbd_s390x as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:643167319e741cb83f17a29563046bc0d0f85120f390f98a78cc9bb511837112_arm64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:8b52eebe27eb0f0b41386912dc1617422c38884e1e09288758899aed587746d4_amd64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:8b579031088212bc58ed3634d64039cc3e1b75da2137383ee89fda6acbf874c9_ppc64le as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:3c5d2c0a1bf582a41938dcf3ad6da603480b6eb15c9fe4e0c5a29ddf25b3d41c_s390x as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:4bfca4203cfb45fb0b0b28a9d1b50a2555cdece4948b9da60825a38508af6f99_ppc64le as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:5ab88cde6c80b3f4412f8ea5969bae19a651673599d46fee3c110690871d907e_amd64 as a component of Logical Volume Manager Storage 4.15
  • registry.redhat.io/lvms4/topolvm-rhel9@sha256:7c6fd669bc33f4d0ec053c007ea747517e865222bce1460db9c82a5ebb7a342b_arm64 as a component of Logical Volume Manager Storage 4.15

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (4)