The Red Hat Trusted Artifact Signer (RHTAS) Operator version 1.3.6, compatible with OpenShift Container Platform versions 4.16 to 4.21, is associated with multiple security vulnerabilities identified by CVE-2026-42211 and eight additional CVEs. These vulnerabilities relate to various CWEs such as improper control of resource states (CWE-770), improper authentication (CWE-289), and information exposure (CWE-201). The advisory does not provide explicit patch or fix information, nor does it confirm active exploitation. The RHTAS Operator is a self-managed on-premise deployment of the Sigstore project, used to cryptographically sign and verify software artifacts to enhance supply chain security. The vendor advisory focuses on the release of version 1.3.6 but does not detail remediation or mitigation measures for the listed vulnerabilities.

The vulnerabilities affect the Red Hat Trusted Artifact Signer Operator, potentially impacting the integrity, authentication, and confidentiality of software artifact signing and verification processes within OpenShift Container Platform environments. The exact impact is not detailed in the advisory, and no known exploits are reported in the wild. Given the involvement of multiple CWEs including authentication bypass and information exposure, these vulnerabilities could pose a high risk to software supply chain security if exploited.

The vendor advisory does not specify any fixes or patches for these vulnerabilities. Patch status is not yet confirmed — check the Red Hat advisory RHSA-2026:42085 and official Red Hat security resources for current remediation guidance. Since this is a self-managed on-premise deployment, users should monitor Red Hat communications for updates or patches. No explicit mitigation steps are provided in the advisory at this time.