Red Hat Security Advisory: VolSync v0.14 security fixes and container updates
VolSync v0.14 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.
AI Analysis
Technical Summary
CVE-2025-47913 affects VolSync v0.14, specifically the golang.org/x/crypto/ssh/agent package used by the SSH agent client. The vulnerability occurs when the client receives a generic SSH_AGENT_SUCCESS (0x06) message in response to requests expecting typed replies. The unmarshalling layer does not handle this unexpected but protocol-legal message type properly, causing the client to panic with "unreachable" code or a nil-pointer dereference. This results in a denial of service by terminating the client process. The flaw is rated as important due to its impact on availability and the reliability break in the unmarshalling logic. Red Hat has addressed this issue in VolSync v0.14.1 container images as part of the Red Hat Advanced Cluster Management for Kubernetes 2.15 update. No other mitigations are currently recommended.
Potential Impact
The vulnerability allows any malicious or misbehaving SSH agent to force a crash in the client process using a single valid protocol byte. This can cause unauthenticated remote denial of service against critical automation or developer tooling that relies on SSH agent interactions, especially in environments using forwarded sockets, shared workspaces, or CI/CD runners. The impact is limited to availability with no confidentiality or integrity effects reported.
Mitigation Recommendations
Red Hat has released updated VolSync v0.14.1 container images containing security fixes. Users should upgrade to these fixed versions as described in the Red Hat Advanced Cluster Management for Kubernetes 2.15 documentation. Currently, no other mitigations meet Red Hat's standards for usability or stability. Monitoring for updates from Red Hat and applying the official fix is the recommended course of action.
Red Hat Security Advisory: VolSync v0.14 security fixes and container updates
Description
VolSync v0.14 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-47913 affects VolSync v0.14, specifically the golang.org/x/crypto/ssh/agent package used by the SSH agent client. The vulnerability occurs when the client receives a generic SSH_AGENT_SUCCESS (0x06) message in response to requests expecting typed replies. The unmarshalling layer does not handle this unexpected but protocol-legal message type properly, causing the client to panic with "unreachable" code or a nil-pointer dereference. This results in a denial of service by terminating the client process. The flaw is rated as important due to its impact on availability and the reliability break in the unmarshalling logic. Red Hat has addressed this issue in VolSync v0.14.1 container images as part of the Red Hat Advanced Cluster Management for Kubernetes 2.15 update. No other mitigations are currently recommended.
Potential Impact
The vulnerability allows any malicious or misbehaving SSH agent to force a crash in the client process using a single valid protocol byte. This can cause unauthenticated remote denial of service against critical automation or developer tooling that relies on SSH agent interactions, especially in environments using forwarded sockets, shared workspaces, or CI/CD runners. The impact is limited to availability with no confidentiality or integrity effects reported.
Mitigation Recommendations
Red Hat has released updated VolSync v0.14.1 container images containing security fixes. Users should upgrade to these fixed versions as described in the Red Hat Advanced Cluster Management for Kubernetes 2.15 documentation. Currently, no other mitigations meet Red Hat's standards for usability or stability. Monitoring for updates from Red Hat and applying the official fix is the recommended course of action.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0527
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-58183"]
Threat ID: 6a160970e29bf47b50637c68
Added to database: 05/26/2026, 20:58:24 UTC
Last enriched: 08/14/2026, 21:56:30 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.