Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1
Multiple security vulnerabilities have been identified in the cert-manager Operator for Red Hat OpenShift 1. 18. 1, which extends Kubernetes by introducing certificate authorities and certificates as first-class resources. These vulnerabilities are tracked under CVE-2025-61727 and related CVEs. The advisory classifies the severity as high. Red Hat provides updated operator images that can be automatically or manually applied depending on the cluster's upgrade policy. No explicit fixes or patches are detailed in the advisory, but upgrading the operator to the latest version is recommended. There are no known exploits in the wild at this time.
AI Analysis
Technical Summary
The cert-manager Operator for Red Hat OpenShift 1.18.1 introduces certificate authorities and certificates as Kubernetes API resources, enabling certificate management within clusters. Multiple vulnerabilities (CVE-2025-61727, CVE-2025-61729, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441) affect this operator, involving weaknesses categorized under CWEs such as CWE-295 (Improper Certificate Validation), CWE-1050, CWE-770, and CWE-409. The Red Hat security advisory RHSA-2026:0990 addresses these issues by providing updated operator images. The upgrade process depends on the installation's approval policy: automatic upgrades occur by default, while manual approval is required if configured. No detailed technical exploit information or patch specifics are provided in the advisory.
Potential Impact
The vulnerabilities affect the cert-manager Operator for Red Hat OpenShift, potentially impacting the security of certificate management within Kubernetes clusters. The high severity rating indicates significant risk if exploited, possibly undermining certificate validation or management processes. However, there are no known exploits in the wild currently. The impact is limited to environments running the affected operator versions.
Mitigation Recommendations
Red Hat recommends upgrading to the latest cert-manager Operator version 1.18.1. If the cluster's upgrade policy is set to 'Automatic' (the default), the operator will upgrade automatically without user intervention. For clusters with a 'Manual' approval policy, administrators must manually approve the upgrade. Prior to upgrading, ensure all previously released relevant errata are applied. Refer to Red Hat's official documentation for detailed upgrade instructions: https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html. No other specific mitigations or workarounds are provided.
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.1
Description
Multiple security vulnerabilities have been identified in the cert-manager Operator for Red Hat OpenShift 1. 18. 1, which extends Kubernetes by introducing certificate authorities and certificates as first-class resources. These vulnerabilities are tracked under CVE-2025-61727 and related CVEs. The advisory classifies the severity as high. Red Hat provides updated operator images that can be automatically or manually applied depending on the cluster's upgrade policy. No explicit fixes or patches are detailed in the advisory, but upgrading the operator to the latest version is recommended. There are no known exploits in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The cert-manager Operator for Red Hat OpenShift 1.18.1 introduces certificate authorities and certificates as Kubernetes API resources, enabling certificate management within clusters. Multiple vulnerabilities (CVE-2025-61727, CVE-2025-61729, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441) affect this operator, involving weaknesses categorized under CWEs such as CWE-295 (Improper Certificate Validation), CWE-1050, CWE-770, and CWE-409. The Red Hat security advisory RHSA-2026:0990 addresses these issues by providing updated operator images. The upgrade process depends on the installation's approval policy: automatic upgrades occur by default, while manual approval is required if configured. No detailed technical exploit information or patch specifics are provided in the advisory.
Potential Impact
The vulnerabilities affect the cert-manager Operator for Red Hat OpenShift, potentially impacting the security of certificate management within Kubernetes clusters. The high severity rating indicates significant risk if exploited, possibly undermining certificate validation or management processes. However, there are no known exploits in the wild currently. The impact is limited to environments running the affected operator versions.
Mitigation Recommendations
Red Hat recommends upgrading to the latest cert-manager Operator version 1.18.1. If the cluster's upgrade policy is set to 'Automatic' (the default), the operator will upgrade automatically without user intervention. For clusters with a 'Manual' approval policy, administrators must manually approve the upgrade. Prior to upgrading, ensure all previously released relevant errata are applied. Refer to Red Hat's official documentation for detailed upgrade instructions: https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html. No other specific mitigations or workarounds are provided.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:0990
- Cve Count
- 5
- Additional Cves
- ["CVE-2025-61729","CVE-2025-66418","CVE-2025-66471","CVE-2026-21441"]
- Cvss Version
- null
Threat ID: 6a16096ae29bf47b50630265
Added to database: 5/26/2026, 8:58:18 PM
Last enriched: 5/27/2026, 1:34:24 AM
Last updated: 5/27/2026, 4:54:11 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.