The cert-manager Operator for Red Hat OpenShift introduces certificate authorities and certificates as Kubernetes API resource types. A race condition vulnerability (CVE-2025-47907) exists in the database/sql package used by the operator, where concurrent queries can yield inconsistent data if a query is cancelled during a Scan method call on returned Rows. This race condition (CWE-362) can lead to unexpected results and potential data inconsistency. The vulnerability is rated high severity by Red Hat but is considered to have limited exploitation scope, primarily affecting applications that cancel queries during concurrent execution. The affected versions include cert-manager Operator for Red Hat OpenShift >=1.17.0 and <1.17.1. Red Hat has released version 1.17.1 with the fix and provides upgrade instructions in advisory RHSA-2026:5645. No exploits in the wild are known. The advisory also references multiple related CVEs and CWE identifiers linked to concurrency and synchronization issues.

This vulnerability can cause inconsistent or unexpected query results in applications using the cert-manager Operator for Red Hat OpenShift when queries are cancelled during concurrent execution. It may lead to data inconsistency but is unlikely to cause direct compromise or privilege escalation. The impact is primarily on data integrity and availability due to race conditions in query handling. The exploitation scope is limited to scenarios where an attacker can initiate and cancel queries concurrently. No known active exploitation has been reported.

Red Hat has released cert-manager Operator for Red Hat OpenShift version 1.17.1 which addresses this vulnerability. Users should upgrade to version 1.17.1 or later. If the operator's installation plan approval policy is set to 'Automatic' (the default), the upgrade will occur automatically. If set to 'Manual', users must manually approve the upgrade. Before upgrading, ensure all previously released errata relevant to your system have been applied. No other specific mitigations are indicated by the vendor advisory.