Red Hat issued a security advisory (RHSA-2026:1042) for the cert-manager Operator for Red Hat OpenShift 1.18.1, addressing multiple vulnerabilities including CVE-2025-61727, CVE-2025-61729, CVE-2025-66418, CVE-2025-66471, and CVE-2026-21441. The cert-manager Operator integrates certificate authorities and certificates as Kubernetes API resources, facilitating certificate management within OpenShift clusters. The advisory references an update to hardened images and RPMs but does not specify individual vulnerability details or CVSS scores. The update is important and should be applied according to the operator's upgrade policy. No exploits in the wild have been reported. The advisory includes instructions for manual or automatic upgrade depending on the configured approval policy.

The vulnerabilities affect the cert-manager Operator for Red Hat OpenShift, potentially impacting the security of certificate management within Kubernetes clusters. The exact impact is not detailed, but the medium severity rating suggests moderate risk. No known active exploitation has been reported. The vulnerabilities could affect the integrity or trustworthiness of certificate issuance or management processes in OpenShift environments using the affected operator version.

Red Hat provides updated images for the cert-manager Operator for Red Hat OpenShift 1.18.1. If the operator's upgrade approval policy is set to 'Automatic' (the default), the update will be applied automatically with no user action required. If the policy is set to 'Manual', administrators must manually approve the upgrade. Before applying this update, ensure all previously released relevant errata have been applied. Follow Red Hat's official documentation for upgrade procedures: https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html. No additional mitigation steps are indicated by the vendor advisory.