The Red Hat Trusted Artifact Signer (RHTAS) Operator version 1.4.2, compatible with OpenShift Container Platform versions 4.17 to 4.22, is associated with multiple security vulnerabilities identified by CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, and CVE-2026-39835. These vulnerabilities are cataloged under CWEs including CWE-281 (Improper Authentication), CWE-1284 (Improper Access Control), CWE-772 (Missing Release of Resource after Effective Lifetime), and CWE-476 (NULL Pointer Dereference). The advisory does not specify detailed technical exploit mechanisms or impacts, nor does it provide patch or remediation details. The RHTAS Operator is a self-managed on-premise deployment of the Sigstore project, used to cryptographically sign and verify container images, binaries, and source code changes to secure the software supply chain.

The vulnerabilities potentially affect the integrity and security of the software supply chain managed via the RHTAS Operator. The referenced CWEs suggest risks related to authentication, access control, resource management, and null pointer dereferences, which could lead to unauthorized actions or system instability. However, no known exploits are reported in the wild, and no explicit impact scenarios are described in the advisory.

The advisory does not provide explicit patches or fixes for these vulnerabilities. No official remediation or temporary fixes are stated. Users should monitor the Red Hat security advisory page for updates and apply any future patches promptly. Since this is a self-managed on-premise deployment, organizations should review their deployment configurations and follow best practices for securing the RHTAS Operator. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.