RHSA-2026:39894 - Security Advisory

Topic

Red Hat OpenStack Services on OpenShift (RHOSO) 18.0.21 containers are now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenStack Services on OpenShift is a hybrid cloud solution for deploying and managing virtualized and containerized applications in a scalable infrastructure with a Red Hat OpenShift Container Platform (RHOCP) control plane.

Security Fix(es):

• opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
• Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
• pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index

For details on how to apply this update to an existing RHOSO 18.0 deployment, see “Updating your environment to the latest maintenance release” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index

Affected Products

• Red Hat OpenStack Services on OpenShift

Fixes

• OSPRH-22189 - The MetricStorage CR should default the networkAttachment to include the default dataplaneNetwork as that is always required for edpm connectivity
• OSPRH-23075 - mariadb-operator stops reconciling galera pods, leaving restarting in wait state
• OSPRH-25543 - Deprecation of Shared File Systems service (manila) API v1 in RHOSO 18 FR6
• OSPRH-25781 - defaultConfigOverwrite doesn't work as described
• OSPRH-25976 - openstack operator / CR does not allow Galera->Secret to be blank
• OSPRH-26029 - Deleting the cinder-api config secret doesn't recreate it
• OSPRH-26177 - There are no nodeSelector on metricStorage
• OSPRH-26189 - rhoso - edpm_users role should disable password expiration for service accounts
• OSPRH-26429 - It looks like some special characters in passwords may block OSCP reconciliation
• OSPRH-26842 - Certain fail-over scenarios impact Shift clusters running RHOSO because ImagePullPolicy is hard coded to "Always" for some operators
• OSPRH-27668 - Auto-generated rootDatabaseAccount may not to be reflected in the Galera CR
• OSPRH-27755 - BUG: OpenstackDataplaneDeployment failing because of container not installed by tripleo running on the compute node
• OSPRH-28323 - Glance image download fails from Swift when swift_store_retry_get_count is None
• OSPRH-28352 - Images signature validation fails on EDPM nodes in disconnected environments
• OSPRH-28657 - After upgrading our OpenStack data plane from TripleO to Red Hat OpenStack Services on OpenShift (RHOSO), iSCSI volume attachments fail due to SELinux context issues on /etc/iscsi/ configuration files.
• OSPRH-29087 - barbican-operator produces continuous ERROR-level log messages on every Secret event in the namespace
• OSPRH-29205 - After a crash, galera's initContainer cannot connect to the mysql database, blocking restart.
• OSPRH-29555 - EDPM config hash contains duplicate hashes
• OSPRH-29689 - dnsmasq should resolve all queries from EDPM nodes for openstack.svc domain
• OSPRH-29899 - [18.0] Add finalizer to Swift Operator Secret to protect HashSuffix
• OSPRH-30538 - Some of glance-cache cleaner pods are stuck in ContainerCreating state because of volume attach problems
• OSPRH-31404 - OVN db restore failing during ctplane infrastructure step
• OSPRH-31531 - [b/r] openstack-swift-object container image misses attr package
• OSPRH-32035 - [FR6] rabbitmq pods can get stuck in terminating preventing rollouts
• OSPRH-32179 - syslog template formatting not possible from telemetry-operator
• OSPRH-32393 - Galera using incorrect cipher set on FIPS-enabled systems during RHOSO backup & restore
• OSPRH-9729 - [Dell PowerStore NFS driver] 'tempest.scenario.test_volume_backup_restore.TestVolumeBackupRestore' keeps failing due to recent fix for CVE-2024-32498 in patch 923244
• RHOSSTRAT-1013 - RHOSO Control Plane Database Backup and Restore Parity with RHOSP 17.1
• RHOSSTRAT-1074 - Extension of edpm-ansible with GPU specific software
• RHOSSTRAT-1197 - Rabbit vhost support is not tested in Component / Integration pipeline
• RHOSSTRAT-1216 - Architectural Regression in nZDPR & CI Enablement
• RHOSSTRAT-1239 - Deprecate rabbitmq-cluster-operator for rhoso 18
• RHOSSTRAT-1302 - Deprecate support for OpenShift 4.16
• RHOSSTRAT-1316 - Update RHOSO-18 Ceph client libraries to ceph9
• RHOSSTRAT-687 - As an operator, I'd like to have a weigher for numbering the instances in RHOSO18
• RHOSSTRAT-888 - [GA] Enhance Swift ring management to support externally managed rings
• RHOSSTRAT-950 - Feature - OIDC Adoption

CVEs

• CVE-2025-52881
• CVE-2026-23490
• CVE-2026-32280

References

• https://access.redhat.com/security/updates/classification/
• https://catalog.redhat.com/software/containers/search