This security advisory concerns multiple vulnerabilities affecting Red Hat Trusted Artifact Signer (RHTAS) version 1.3.2, which integrates with OpenShift Container Platform versions 4.16 to 4.20. The vulnerabilities are tracked under CVE-2025-47913, CVE-2025-61729, CVE-2025-66506, and CVE-2026-22772, involving weaknesses such as improper access control (CWE-1050), improper resource shutdown or release (CWE-405), and improper control of resource through a semaphore (CWE-918). The advisory does not list any patches or fixes for these vulnerabilities, and no known exploits in the wild have been reported. The product facilitates cryptographic signing and verification of container images, binaries, and source code changes to maintain software supply chain security.

The vulnerabilities affect the integrity and security assurance capabilities of the Red Hat Trusted Artifact Signer, potentially undermining the cryptographic signing and verification processes for software artifacts. This could impact organizations relying on RHTAS to ensure the authenticity and integrity of container images and other software components. However, no known exploits have been reported in the wild, and the advisory does not specify direct exploitation consequences.

The vendor advisory does not indicate the availability of any patches or fixes for these vulnerabilities at this time. Users should monitor Red Hat's official advisories and update channels for any forthcoming patches or updates. Since this is a self-managed on-premise deployment, organizations should review their deployment configurations and consider additional compensating controls to protect the software supply chain until official fixes are released.