The Red Hat OpenShift Pipelines Operator 1.15.3 release resolves a set of security vulnerabilities affecting the product. These include CVE-2024-37890 and ten other CVEs related to various weaknesses categorized under CWEs such as CWE-770, CWE-20, CWE-179, CWE-1321, CWE-674, and CWE-405. The operator leverages Tekton CRDs to automate CI/CD pipelines across Kubernetes platforms. The advisory does not provide detailed technical descriptions of each vulnerability but indicates a collective fix in this release. No CVSS scores are provided, and no exploits are known in the wild.

The vulnerabilities affect Red Hat OpenShift Pipelines Operator, potentially impacting the security and reliability of CI/CD pipeline automation on Kubernetes clusters. The exact impact of each CVE is not detailed, but the overall severity is rated high by the vendor. Since no known exploits are reported, the immediate risk may be limited but could allow attackers to exploit weaknesses if unpatched.

A fixed version, Red Hat OpenShift Pipelines Operator 1.15.3, has been released addressing these vulnerabilities. Users should upgrade to this version to remediate the security issues. The vendor advisory does not indicate any temporary mitigations or that no action is required. Patch status is confirmed by the official Red Hat advisory RHSA-2026:3710.