CVE-2026-16221VulnerabilityPublished 8 Sep 2026Updated 26 Oct 2026

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update

Affects Red HatSource GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 8 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

Description

Red Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-10056: [Backport to odf-4.22.z] [IBM_Support]Capturing the db dump is failing in ODF 4.19 DFBUGS-9935: [ODF 4.22.z] ODF Upgrade fails when client operator completes upgrade before ocs-operator DFBUGS-9720: [Backport to odf-4.22.3] [RDR] odf dr validate application validation failes when there are more the one pair for RDR cluster DFBUGS-9561: [Fusion-Access MDR] With multiple apps(managed+disapp) there can be a race flip global vgr to secondary during cleanup DFBUGS-9401: on TNF - mon-c svc created with the wrong label selector during installation DFBUGS-9376: [Fusion-Access MDR][CNSA]: CNSA controller memory limit incorrectly reconciled to 400Mi by odf-operator DFBUGS-9015: [Backport to odf-4.22.z] [GSS] PVPool pod failing to start while nooba operator is scaled up DFBUGS-9002: [Fusion-Access MDR]: DRPC Progression state incorrectly reports "Completed" after failover while applications remain active on primary site (C1) DFBUGS-8993: [Fusion-Access MDR][Tracker-CNSA-11777]: collectFsRecoveryData.sh script collects all filesystem resources instead of target filesystem, causing risk of overwriting existing C2 configurations DFBUGS-8904: [Rook] Operator fails trying to mute a non existent - AUTH_INSECURE_SERVICE_KEY_TYPE error. DFBUGS-8878: [FusionAccess-MDR]: Add LUN group creation failing on secondary (c2) cluster due to missing devicefinder configmap for compute-0 DFBUGS-8860: [Fusion-Access MDR][UI]: On c2, UI incorrectly displays "Unhealthy" status for Filesystem (FS) resource when status is empty DFBUGS-8838: Update Rook toolbox to use keyring from volume mount instead of env var DFBUGS-8290: [FusionAcess-Migration] Post migration Data Foundation service is not showing in installed services list DFBUGS-8204: [Migration] After Fusion Access migration not able to create PVC using new Storageclass DFBUGS-8118: [FusionAcess-Migration]Migration tool doesn't handle case where kmm-operator is installed in NS other than ibm-fusion-access DFBUGS-6369: [DRBD UI] Correct the pre-requisite re-direct link once odf tnf docs are ready

CWE-807Reliance on Untrusted Inputs in a Security Decision (opens in a new tab)
Base weaknessLikelihood of exploit: HighOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Architecture and Design · Attack Surface Reduction
Store state information and sensitive data on the server side only.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks…
OWASP Cheat Sheets
Secure Design Principles (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
OWASP Cheat Sheets
File Upload (opens in a new tab)
OWASP ASVS 4.0.3
V12.1.1 (opens in a new tab)
Attack patterns
Exponential Data Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Description

WeaknessesCWE-807, CWE-770, CWE-835 +1

Technical details

References

Community reviews

Related threats