RHSA-2026:2343 - Security Advisory

Topic

A new version of OpenShift API for Data Protection (OADP) is now available.

Description

OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Fixes

• BZ - 2418462
• BZ - 2404715
• BZ - 2407258
• OADP-6352 - Update doc w/ restic removal
• OADP-6361 - Doc: Backup fails because of dataupload failure when backup pod is scheduled on master nodes
• OADP-6700 - reconcile errors in the oadp-non-admin controller as backups are created.
• OADP-6798 - Doc: more than one BSL connected to the same s3 endpoint and velero prefix is NOT supported.
• OADP-6799 - (QE) OADP-OADP 1.5.4 release activities
• OADP-6800 - (QE) [OADP 1.5.4] Review tickets for OADP 1.5.4
• OADP-6801 - (QE) [OADP 1.5.4] Test matrix ran and passed
• OADP-6802 - (QE) [OADP 1.5.4] Make sure to deploy oadp using UI
• OADP-6804 - (QE) [OADP 1.5.4] Run the tests when oadp is pushed to production
• OADP-6805 - (QE) [OADP 1.5.4] Run the tests when oadp is pushed to STAGING
• OADP-6806 - (QE) [OADP 1.5.4] Push to REL_PREP
• OADP-7345 - (QE) (jira-auto) Automation Failure & skipped Analysis 1.5.4-1 and Update RP
• OADP-7348 - (QE) (jira-auto) KUBEVIRT_GCP_GCP
• OADP-7366 - [IBM QE-Z] Verify Bug OADP-6700 - reconcile errors in the oadp-non-admin controller as backups are created.
• OADP-7385 - [DOC] Release Notes and Attributes Update for OADP 1.5.4

CVEs

• CVE-2024-25621
• CVE-2025-52881
• CVE-2025-58183
• CVE-2025-61729

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore