This advisory covers Red Hat OpenShift Data Foundation 4.17.24, which addresses several security vulnerabilities and bugs. The fixed bugs include removal of the use of the image gcr.io/kubebuilder/kube-rbac-proxy by the ocs-operator and resolving an external mode issue where the noobaa-default-backing-store remains in a creating state due to a self-signed certificate in the chain error. The advisory references four CVEs: CVE-2025-61729, CVE-2026-4800, CVE-2026-33036, and CVE-2026-34986. The vendor advisory does not provide explicit CVSS scores or detailed technical exploit information. The update is intended to improve security and stability of the product.

The vulnerabilities addressed are considered high severity by the vendor. The issues fixed include potential security risks related to improper image usage and certificate validation failures that could affect the availability or security posture of the OpenShift Data Foundation environment. No known exploits in the wild have been reported. The impact is primarily on Red Hat OpenShift Data Foundation 4.17 deployments.

A security update to Red Hat OpenShift Data Foundation 4.17.24 has been released that includes fixes for the referenced vulnerabilities and bugs. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available in the vendor documentation. No additional mitigation actions are specified beyond applying the official update.