RHSA-2026:56928 | Vulnetix

RHSA-2026:56928 PUBLISHED CVSS 7.5 HIGH

A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/odf4/ocs-tls-profiles-operator-bundle@sha256:6090dba2c45498f2e34dd56e7465ece339a53d7daa45a32564fbd7c2172002ba_amd64 as a component of Red Hat Openshift Data Foundation 4.22	*
Red Hat	registry.redhat.io/odf4/odf-cli-rhel9@sha256:0b9c74669c20703568abfdbd9c86bdf1b94b599014341fe4c355e1c90d5df479_amd64 as a component of Red Hat Openshift Data Foundation 4.22	*
Red Hat	registry.redhat.io/odf4/mcg-rhel9-operator@sha256:d6638e2c155622e06b1ac4b01e9424f6f0fa3f5dc8ce5976d30cbe030262a4e6_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:5b1ca842e25121c65f2b5feb366d24e673af3236fdbb95fc5021dac442ebd114_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/cephcsi-rhel9@sha256:e22ce5d41f0fab1983cb49db6578b998cee47f4a205459c08f6527a416ddac1e_ppc64le as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:675dffb6659d2f7e2975a47bd1fb94b3930a441ec81b3e12a6574fce2f49495a_ppc64le as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:f561525d76d9cea860a8c4660921d44f509008f91ec06780a40d8c1e55776280_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:f73962e02182e930d616f1af27f64ae58b1e50092e81c558cc8bac944919e294_s390x as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:10dd80b3ad82c20eef3c275ae4e60e096e70da1d1caf2617c343ee87796216c3_amd64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:5083229ec138c7e6ba571fcdd7f6f1114e72949b5be9effe56555dbe981627d1_amd64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:509e48275e711edac6e26db6a81cd05d2aa1e5e7a5f7315879cd8ac1e87480c8_ppc64le as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-console-rhel9@sha256:c1c6cc051dd6d7f0662d7a713d4c95165711e05106269237279c9e44e3ffdce8_amd64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-rhel9-operator@sha256:02966c37e1ed05a81bd91049246f8954dd3bc9a068ff0922cd349c7a17c3fb74_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:0f0dc03a1726bb4099b389b490d86924e7249deb8227a49954409ebd2f9827cc_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/cephcsi-rhel9@sha256:f46cbaa4c84c3de5822b1fbd4556213492d519e772aee22828c17702a3262a5b_amd64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:603e5a3da3f7f067355dfda3e2fbe85b9b8be702418ce57fb3ee3f8abfed81cc_amd64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:1a9ff06c118f15331871404828d90e09db1a58802dc892308f486eb73c18d509_ppc64le as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:b16101d3c9092d128dbf3318b7f7d0890343f9c6203567195ada9cbac319b142_s390x as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-cli-rhel9@sha256:56d480e3ef748558a72f0fd20378496921c7d821d38998fea29d9cd9f18839d9_arm64 as a component of Red Hat Openshift Data Foundation 4.22	,
Red Hat	registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:4e6c58356db3db6c95f61d48678d32d722592268753ed591429b77cd4da9b269_ppc64le as a component of Red Hat Openshift Data Foundation 4.22	*

…and 105 more

Timeline

Aug 19, 2026 CVE Published
Aug 25, 2026 CVE Updated
Aug 25, 2026 Distribution Patch
Aug 25, 2026 Distribution Patch
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory
Aug 25, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:56928 advisory
https://access.redhat.com/security/cve/CVE-2026-33671 advisory
https://access.redhat.com/security/cve/CVE-2026-33672 advisory
https://access.redhat.com/security/cve/CVE-2026-33750 advisory
https://access.redhat.com/security/cve/CVE-2026-40181 advisory
https://access.redhat.com/security/cve/CVE-2026-41305 advisory
https://access.redhat.com/security/cve/CVE-2026-41650 advisory
https://access.redhat.com/security/cve/CVE-2026-41907 advisory
https://access.redhat.com/security/cve/CVE-2026-42338 advisory
https://access.redhat.com/security/cve/CVE-2026-44665 advisory
https://access.redhat.com/security/cve/CVE-2026-45149 advisory
https://access.redhat.com/security/cve/CVE-2026-45736 advisory
https://access.redhat.com/security/cve/CVE-2026-6321 advisory
https://access.redhat.com/security/cve/CVE-2026-6322 advisory
https://access.redhat.com/security/cve/CVE-2026-9358 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_56928.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2466582 issue
https://www.cve.org/CVERecord?id=CVE-2026-6321 advisory

…and 72 more

Open in Interactive Console →