This advisory covers vulnerabilities in the Red Hat Trusted Artifact Signer (RHTAS) Policy Controller Operator, a Helm-based operator for deploying and managing Sigstore Policy Controller instances on OpenShift Container Platform versions 4.16 to 4.22. The advisory references four CVEs (CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39835) and associates several CWEs (CWE-281, CWE-1284, CWE-772, CWE-476) indicating issues related to improper access control, permissions, resource management, and null pointer dereferences. The advisory does not provide a patch or remediation and does not indicate any known active exploitation. The operator is intended for on-premise deployment to enforce supply-chain metadata policies on OpenShift clusters. The vendor advisory and references do not specify fixed versions or mitigation steps beyond usage documentation.

The vulnerabilities potentially affect the security posture of OpenShift clusters using the RHTAS Policy Controller Operator by introducing risks related to access control, permissions, resource management, and null pointer dereferences. These issues could lead to unauthorized actions or system instability within the operator's scope. However, no known exploits are reported in the wild, and the exact impact details are not provided in the advisory.

No official fix or patch is currently available for these vulnerabilities according to the vendor advisory. Users should monitor Red Hat's official security advisories for updates and apply patches once released. In the meantime, follow best practices for limiting access to the operator and carefully review deployment configurations. Refer to the official product documentation for guidance on secure usage: https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4.