The Red Hat Trusted Artifact Signer (RHTAS) Operator, compatible with OpenShift Container Platform versions 4.16 to 4.21, has multiple vulnerabilities identified by CVE-2026-33815, CVE-2026-33816, and CVE-2026-34986. These vulnerabilities are associated with weaknesses categorized under CWE-787 (Out-of-bounds Write) and CWE-131 (Incorrect Calculation of Buffer Size). The advisory does not provide CVSS scores or detailed exploitation information. No fixes or patches are explicitly mentioned in the vendor advisory. RHTAS is designed to simplify cryptographic signing and verification of container images, binaries, and source code to enhance software supply chain security.

The vulnerabilities affect the integrity and security of the Red Hat Trusted Artifact Signer operator, potentially impacting the cryptographic signing and verification processes of software artifacts. This could undermine the assurance of software supply chain integrity in environments using RHTAS with OpenShift Container Platform versions 4.16 through 4.21. No known exploits in the wild have been reported at this time.

The vendor advisory does not mention any available patches or fixes for these vulnerabilities. Patch status is not yet confirmed — check the Red Hat advisory RHSA-2026:24475 for current remediation guidance. Users should monitor official Red Hat communications for updates and apply any future patches promptly. No specific temporary mitigations are provided in the advisory.