Red Hat Security Advisory

RHSA-2026:17549

Red Hat OpenShift Data Foundation 4.16.26 security, enhancement & bug fix update

Released 2026-05-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15

Fixes 2 records

TI-2026-25482 CVE-2026-33036 · GHSA-8gc5-j5rx-235r

fast-xml-parser affected by numeric entity expansion bypassing all entity expansion…

HIGH 72

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00612 Published 2026-03-20 Partial fix · 5.5.6, 4.5.5 CWE-776

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94