RHSA-2026:26412 - Security Advisory

Topic

Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update

Description

Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update

FIXED BUGS:
==========
DFBUGS-7104: [Backport to 4.20.z] CLONE - ODF Console is breaking
DFBUGS-7079: NooBaa upgrade failure due to remove_mongo_pool.js error
DFBUGS-7066: RHODF 4.20.14 release
DFBUGS-7045: [5.20] Update nodejs from v22.11.0 to v24.13.0
DFBUGS-7016: [Critical] Upgrade ceph version to RHCEPH-8.1z6 at ODF-4.20.13
DFBUGS-6953: Upgrade the package on-headers and undici to fix cve CVE-2025-7339, CVE-2026-22036
DFBUGS-6872: [Backport to 4.20] INVALID_SCHEMA_REPLY SERVER after upgrading ODF to 4.21
DFBUGS-6846: Backport to odf-4.20.z intermittent S3 upload failures (HTTP 500 / InternalError) when uploading files to NooBaa buckets via JFrog Artifactory
DFBUGS-6740: Backport to odf-4.20.z ODF 4.16.21- noobaa-endpoint crashes with Exit Code 1 due to unhandled AbortError from @azure/storage-blob
DFBUGS-6705: Backport to odf-4.20.z [GSS] Unnecessary OSD redeployments on 4.19.z upgrade for already-encrypted OSDs
DFBUGS-6673: [Backport to odf-4.20] - Random Pod delete makes the container in openshift-storage.rbd.csi.ceph.com-nodeplugin-csi-addons restart
DFBUGS-6541: [ODF 4.20.z CLONE] - Provider Server sends sub channel to client only when provider side csv is at the tip of the sub channel in the catalogsource
DFBUGS-6533: [Backport to 4.20.z][GSS] Missing default tolerations
DFBUGS-6531: [ODF 4.20.z] CLONE - Missing toleration for node.ocs.openshift.io/storage in rook-ceph-rbd-mirror pod
DFBUGS-6487: [Backport to odf-4.20.z] rook-ceph-exporter log causes huge ODF must-gather
DFBUGS-6460: Backport to odf-4.20.z [RDR] Partial s3StoreProfile missing in ramen-hub-operator-config after upgrading hub from ODF 4.17 to 4.18
DFBUGS-6176: Backport to odf-4.20.z Noobaa POD keeps Failing when Clusterwide encryption is enabled with IBM KeyProtect on ROKS Cluster
DFBUGS-5746: [Backport to odf-4.20.z] Ceph PVC's not provisioning or mounting after ODF v4.20 upgrade

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.20/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf

Affected Products

• Red Hat OpenShift Data Foundation

Fixes

CVEs

• CVE-2026-33186

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/