RHSA-2026:91613 - Security Advisory

Topic

A new version of OpenShift API for Data Protection (OADP) is now available.

Description

OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Affected Products

• OpenShift API for Data Protection

Fixes

• BZ - 2484204
• BZ - 2484205
• BZ - 2484207
• OADP-2938 - Backup should immediately fail when nodeAgent pods are not running
• OADP-6065 - Backup Partially Fails with AWS bucket with " region not found ", in absence of VSL spec.
• OADP-7384 - Errors in backups from leftover references.
• OADP-7467 - VMFR controller fails to create resources in user specified namespace
• OADP-7892 - CLONE - [CSI] VGS restore fails when used with Ceph RBD storage class
• OADP-7895 - oc oadp nonadmin backup describe shows "Pod Volume Backups: <none included>" even when Kopia PVBs completed successfully
• OADP-7953 - CLONE 1.6 - Node agent pod restarts cancel all DataUploads across all nodes, blocking backup queue in OADP 1.5
• OADP-7984 - PodConfig.PriorityClassName not propagated to node-agent ConfigMap for data mover pods
• OADP-7996 - Kubevirt-velero-plugin causes PartiallyFailed backups on clusters without OpenShift Virtualization
• OADP-8056 - OADP should create Secret from inline CACert and use CACertRef on Velero BSL for cert rotation support
• OADP-8085 - withCLONE - CloudStorage GCP bucket reconciliation fails with BucketCheckError on missing bucket
• OADP-8146 - NetworkAttachmentDefinitions are not backed up as part of KubeVirt VM backups (kubevirt-velero-plugin)
• OADP-8216 - [4.17] OADP Backups Fail when VM is attached to NAD in "default" namespace
• OADP-8333 - OADP VM backup succeeds but `labelSelector` skips `virt-freezer` hooks (HooksAttempted: 0), producing crash-consistent backups
• OADP-8445 - download containers, Container does not have ReadinessProbe defined
• OADP-8447 - OADP cli/vmdp: access-control-pod-role-bindings Ensures that a workload does not utilize RoleBinding(s) in a non-workload Namespace.
• OADP-8448 - cli / vmdp: access-control-pod-service-account Ensure that the each workload Pod is configured to use a valid Service Account
• OADP-8483 - lifecycle-liveness/readiness/startup-probe Create probes for cli / vmd
• OADP-8704 - [GCP WIF] BackupStorage goes to unavailable status when cloudStorage CR has a region field
• OADP-8791 - Regression in velero-plugin-for-aws for non-AWS S3 buckets
• OADP-8792 - Openshift Velero Plugin should backup trusted CAs with cluster proxy configuration
• OADP-8830 - the non-admin controller pod is entering crashloopbackoff
• OADP-8861 - Velero deletes VGS resources before CSI backup finalization causing backup to partially fail

CVEs

• CVE-2026-27145
• CVE-2026-42504
• CVE-2026-42507

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore