This Red Hat security advisory covers multiple vulnerabilities fixed in RHACS 4.5 and Red Hat OpenShift Data Foundation 4.15. Key vulnerabilities include CVE-2024-11831, a Cross-site Scripting (XSS) vulnerability in the npm serialize-javascript package; CVE-2025-21613 and CVE-2025-21614, argument injection and denial of service vulnerabilities in go-git clients; CVE-2024-45337, an authorization bypass caused by misuse of ServerConfig.PublicKeyCallback in golang.org/x/crypto; and CVE-2024-45338, a non-linear parsing issue in golang.org/x/net/html. The advisory provides updated container images and software versions that address these issues. The vendor recommends upgrading to RHACS 4.5.6 and OpenShift Data Foundation 4.15.14 to apply these security fixes. No known exploits in the wild have been reported at this time.

The vulnerabilities fixed in this advisory have high severity and could allow attackers to perform Cross-site Scripting (XSS), argument injection, denial of service (DoS), and authorization bypass attacks. These issues affect components used within RHACS and OpenShift Data Foundation, potentially impacting the security of Kubernetes cluster management and storage services. Exploitation could lead to unauthorized access, service disruption, or execution of malicious scripts. However, there are no known active exploits reported in the wild for these vulnerabilities as of the advisory date.

Red Hat has released updated versions RHACS 4.5.6 and OpenShift Data Foundation 4.15.14 containing fixes for the listed vulnerabilities. Users should upgrade to these versions as soon as possible to mitigate the risks. The vendor advisory explicitly recommends applying these updates and does not indicate any alternative mitigations or that no action is required. Patch status is confirmed as official fixes are available.