RHSA-2026:26568HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

Published
June 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (10)

CVE-2026-32281 →CVE-2026-32282 →CVE-2026-33186 →CVE-2026-33747 →CVE-2026-33748 →CVE-2026-33810 →CVE-2026-34986 →CVE-2026-25679 →CVE-2026-27137 →CVE-2026-32280 →

📋 Description

CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33747 — BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend CVE-2026-33748 — github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products46

  • OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x as a component of OpenShift API for Data Protection 1.5
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 as a component of OpenShift API for Data Protection 1.5
  • +16 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.

🔗 References (14)