The cert-manager Operator for Red Hat OpenShift extends Kubernetes by managing certificate authorities and certificates as native API resources, facilitating certificate-as-a-service functionality. Several vulnerabilities, including CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441, have been reported affecting version 1.18.1. The vulnerabilities are associated with CWEs 770 (Allocation of Resources Without Limits or Throttling) and 409 (Improper Synchronization), indicating potential resource management and concurrency issues. The Red Hat advisory (RHSA-2026:1176) does not list explicit fixes or patched versions but indicates that operator upgrades are available and can be applied automatically or manually depending on the approval policy. No cloud service is involved, and no exploits are known in the wild at this time.

The vulnerabilities affect the cert-manager Operator for Red Hat OpenShift 1.18.1, potentially impacting the management of certificates and certificate authorities within Kubernetes clusters. The high severity rating suggests significant risk, possibly including resource exhaustion or concurrency-related issues, but no specific impact scenarios or exploitation details are provided. No known active exploits have been reported. The operator's functionality is critical for secure certificate management in OpenShift environments, so these vulnerabilities could affect cluster security if exploited.

Red Hat recommends ensuring that all previously released errata relevant to your system are applied before upgrading. If the cert-manager Operator installation uses the default 'Automatic' approval policy, the operator will upgrade automatically with no user action required. For installations with a 'Manual' approval policy, manual approval of the operator upgrade is necessary. Users should follow the official Red Hat OpenShift documentation for cert-manager Operator upgrades at https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html. Since no explicit fixes are detailed in the advisory, users should monitor Red Hat advisories for updates and apply operator upgrades promptly to mitigate the vulnerabilities.