Red Hat issued a security advisory (RHSA-2026:11408) for VolSync v0.14, a Kubernetes operator enabling asynchronous replication of persistent volumes. The advisory addresses multiple vulnerabilities identified by CVE identifiers CVE-2025-61726, CVE-2025-61728, CVE-2025-61729, CVE-2026-32282, and CVE-2026-33186. These vulnerabilities are rated with an important security impact by Red Hat Product Security. The advisory provides updated container images and security fixes in VolSync v0.14.2, distributed as part of Red Hat Advanced Cluster Management for Kubernetes 2.15. The vulnerabilities relate to CWEs including improper resource management (CWE-770), use of risky functions (CWE-1050), time-of-check to time-of-use race conditions (CWE-367), and exposure of sensitive information to unauthorized actors (CWE-551). No CVSS base score is provided in the advisory.

The vulnerabilities affect the security and reliability of VolSync v0.14, potentially impacting the asynchronous replication of persistent volumes in Kubernetes clusters. The issues could lead to improper resource management, race conditions, or unauthorized information exposure, which may compromise data integrity or confidentiality within affected Kubernetes environments. Red Hat rates the overall security impact as important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released VolSync v0.14.2 with security fixes and updated container images as part of Red Hat Advanced Cluster Management for Kubernetes 2.15. Users should upgrade to this fixed version to address the vulnerabilities. The vendor advisory is the authoritative source for remediation and provides updated images for multiple architectures. Patch status is confirmed with an official fix available. No additional mitigation steps beyond applying the update are specified.