The Red Hat Trusted Artifact Signer (RHTAS) version 1.3.5, used with OpenShift Container Platform 4.16 to 4.21, has been identified with multiple security vulnerabilities including CVE-2026-4660, CVE-2026-32280, and CVE-2026-33810. These vulnerabilities relate to issues such as path traversal (CWE-22) and other weaknesses (CWE-770, CWE-1289). The CVSS vector for CVE-2026-4660 indicates a network attack vector with low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. The Red Hat advisory does not list any available patches or fixes for these vulnerabilities as of the publication date. The product is a self-managed on-premise deployment of the Sigstore project, used to cryptographically sign and verify software artifacts to maintain supply chain security.

The vulnerabilities potentially allow unauthorized access to sensitive information due to the high confidentiality impact indicated by CVE-2026-4660. There is no reported impact on integrity or availability. No known exploits are currently observed in the wild. The affected component is critical for ensuring the integrity and transparency of software supply chains in environments using OpenShift Container Platform versions 4.16 through 4.21.

The Red Hat advisory does not provide any patches or fixes for these vulnerabilities at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Red Hat's official security advisories for updates. Since this is a self-managed on-premise deployment, organizations should consider risk mitigation strategies appropriate to their environment until an official fix is released.