The Red Hat Trusted Artifact Signer (RHTAS) Operator, used with OpenShift Container Platform versions 4.16 to 4.21, is affected by multiple high-severity vulnerabilities (CVE-2026-33815, CVE-2026-33816, CVE-2026-34986). These vulnerabilities relate to memory safety issues such as out-of-bounds writes and incorrect buffer size calculations (CWE-787, CWE-131). The CVSS vector for CVE-2026-33815 indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The advisory does not provide any patch or remediation details, and no known exploits in the wild have been reported. RHTAS is a self-managed on-premise deployment of the Sigstore project to cryptographically sign and verify software artifacts.

Successful exploitation of these vulnerabilities could lead to complete compromise of confidentiality, integrity, and availability of the affected systems running Red Hat Trusted Artifact Signer. Given the nature of the vulnerabilities (memory corruption issues), attackers could potentially execute arbitrary code or cause denial of service. The high CVSS severity reflects the critical impact on affected environments.

As of the advisory publication, no official patches or fixes have been released for these vulnerabilities. Users should monitor Red Hat's official security advisories and update promptly once a fix becomes available. Since this is a self-managed on-premise deployment, organizations should consider limiting network exposure of the RHTAS Operator and apply standard security best practices to reduce risk until a patch is provided.