This advisory concerns vulnerabilities affecting Red Hat Trusted Artifact Signer (RHTAS) Operator 1.3.5, which integrates with OpenShift Container Platform versions 4.16 to 4.21. The vulnerabilities are catalogued under CVE-2026-4660, CVE-2026-32280, and CVE-2026-33810, with associated CWEs including CWE-22 (Path Traversal), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-1289 (Untrusted Pointer Dereference). The advisory does not provide CVSS scores, detailed technical descriptions, or patch availability. The product facilitates cryptographic signing and verification of software artifacts to ensure supply chain integrity. No official fixes or mitigations are documented in the advisory content provided.

The vulnerabilities are rated as high severity but lack detailed impact descriptions or exploitation evidence. They potentially affect the integrity and security of software supply chains managed via RHTAS. No known exploits in the wild have been reported. Without patches or mitigations, affected deployments may be exposed to risks related to the identified CWEs, which could lead to unauthorized access, resource exhaustion, or pointer dereference issues.

Patch status is not yet confirmed — check the Red Hat advisory RHSA-2026:24478 and official Red Hat security resources for current remediation guidance. No fixes are explicitly provided in the advisory content. Users should monitor Red Hat's security updates and apply any future patches promptly. As the product is self-managed on-premise software, administrators should review deployment configurations and restrict access as a precaution until official fixes are available.