VDB
RHSA-2026%3A26416
RHSA-2026%3A26416
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:bae0120899ef5e5e677e76e88c7f1e9e02c16de0bd241f80036a59d190063343_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:64a115196f540837ede6c4aa609a1af755a72b11566906c598f63d50004b8324_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:41ec6bee58683e5e43fee32fc919de3dc8daddc8de7cd2b669126e6801fbaf00_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:100cf9edfb78d3ffb63d8b812a384aadd4cf475582c948b2f4b9971b39e129f1_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/cephcsi-rhel9@sha256:f69bcbc5bdf7272f9d6ff498d7050551eb68d90b49a62fb7b064c619b37cc629_s390x as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:eedc6c9a38e39361ae04d9b750b94a0d539d2d4507c7274dc1b3c0846269baf0_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:079167c8672badb44551a922805ea810c0ae91af7f4616e8b87facb163599ef5_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:5a1cd02e31cfd8a84b1fd49dbc4ecf6b225fb31dc79c978ec954b7a104673739_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:c5006cefd5b859158eccd466b888efc80961bf33db621d56b0f5becad4d65f3f_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/ocs-operator-bundle@sha256:0dbecb19f18e46b109c928bb4f94d1a680adfbc8af91f20a13717830ccb97eba_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-operator-bundle@sha256:aa71adbe901fd559b5bf8b39b878187d97f7715c7723b4dd7ba5b6fee856f075_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-console-rhel9@sha256:53fdb9e72c231c5d63e3957cadc42bd7b4043dd4a41ed6a356ec8f36402afcf8_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-core-rhel9@sha256:cf532216fd16054fc33c7b89ee46b96ff41b9efc410a9934c60e65c6ed6006b2_s390x as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-multicluster-operator-bundle@sha256:99a297324487c756e225192b3b8048a9eed953f8e4eff6ba1cba466b4dead6f5_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-cli-rhel9@sha256:67e27737e1f7575b2e326a22cda7873793b88c35decb2525e92fa0dcc78216bb_arm64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:6a6b1c4e9b737fa2ce70779a58eeb5c6cfaa81d3cf7bb9d5ca3270082f3436dd_amd64 as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/mcg-rhel9-operator@sha256:77ec395add21168ca60cd78c4b7d938d4a5c7766ce8037bfe1d6a221a38fd79b_s390x as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-rhel9-operator@sha256:6d1a86c208ce01e7ab603e582e494013398dca6f5e5d82b143fd39796d5348ea_s390x as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:8d05e234d03462e5b1a3758e9be6d6883e844749de908c3c3a2334c64db5f328_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
| Red Hat | registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:6f6a208f69ed10ba8bc11ce5aeb9dffe758726c7ff6d98f4521df0ba4052203e_ppc64le as a component of Red Hat Openshift Data Foundation 4.16 | *, *, * |
…and 55 more
Timeline
- Jun 16, 2026 CVE Published
- Jun 17, 2026 Distribution Patch
- Jun 17, 2026 Distribution Patch
- Jun 17, 2026 Security Advisory
- Jun 17, 2026 Security Advisory
- Jun 17, 2026 Security Advisory
- Jul 15, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:26416 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-6321 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26416.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466582 issue
- https://www.cve.org/CVERecord?id=CVE-2026-6321 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6321 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449833 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 advisory
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 advisory