This advisory covers a security update for Red Hat OpenShift GitOps, specifically version 1.18.5. It fixes a bug where the OpenShift GitOps Operator v1.19.2 had hardcoded pod-security labels that conflict with OpenShift Container Platform versions 4.16 and earlier. Additionally, it addresses multiple CVEs found in ose-kube-rbac-proxy images included in OpenShift GitOps versions 1.19.2 and 1.20.1. The CVE-2026-27137 vulnerability is noted with a CVSS vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The advisory is identified as RHSA-2026:9697 and recommends updating to version 1.18.5 after applying all previous errata.

The vulnerability CVE-2026-27137 has a high severity rating with an impact primarily on availability, meaning exploitation could cause denial of service or disruption of service. There is no confidentiality or integrity impact reported. The hardcoded pod-security labels issue could cause conflicts in environments running OpenShift Container Platform 4.16 or earlier, potentially affecting deployment or security policies. Multiple CVEs in dependent ose-kube-rbac-proxy images could also pose security risks if unpatched.

A security update is available in Red Hat OpenShift GitOps version 1.18.5. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. The vendor advisory provides detailed instructions on applying the update. No additional mitigation steps are indicated beyond applying the official update.