Red Hat issued a security advisory (RHSA-2026:11803) for VolSync v0.15, a Kubernetes operator that replicates persistent volumes asynchronously. The advisory addresses security vulnerabilities identified as CVE-2026-32282 and CVE-2026-33186, which have been rated with an important security impact by Red Hat Product Security. The update includes security fixes and updated container images delivered in VolSync v0.15.1, which is part of Red Hat Advanced Cluster Management for Kubernetes 2.16. The vulnerabilities are associated with CWE-367 (Time-of-check Time-of-use Race Condition) and CWE-551 (Missing Release of Resource after Effective Lifetime). The advisory does not provide a CVSS score but references CVE links for detailed severity ratings. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities affect the VolSync operator used in Kubernetes environments for persistent volume replication, potentially impacting data replication integrity or resource management. The security impact is rated as important by Red Hat, indicating a significant risk if exploited. However, no known exploits in the wild have been reported. The vulnerabilities relate to race conditions and resource release issues, which could affect the reliability or security of data replication processes.

Red Hat has released VolSync v0.15.1 containing security fixes and updated container images to address the vulnerabilities. Users of Red Hat Advanced Cluster Management for Kubernetes 2.16 should update to this fixed version to mitigate the security risks. The vendor advisory provides detailed instructions and updated images for remediation. Patch status is confirmed with an official fix available. No additional mitigation actions are specified beyond applying the update.