The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, and 5.0

Red Hat Security Advisory: RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

The 3.30.1 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates  to Dev Spaces 3.30.
Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a  browser-based IDE built for teams and organizations. Dev Spaces runs in  OpenShift and is well-suited for container-based development. 
The 3.30 release is based on Eclipse Che 7.121 and uses the DevWorkspace engine  to provide support for workspaces based on devfile v2.1 and v2.2. 
Users still using the v1 standard should migrate as soon as possible. 
https://devfile.io/docs/2.2.0/migrating-to-devfile-v2 
Dev Spaces supports OpenShift EUS releases v4.16 and higher. Users are  expected to update to supported OpenShift releases in order to continue to get Dev  Spaces updates. 
https://access.redhat.com/support/policy/updates/openshift#crw

Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.57. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:60018

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.17.57 bug fix and security update

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

Security Fix(es):

* ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution (CVE-2026-11332)
* automation-controller: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)
* automation-controller: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
* automation-gateway: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization (CVE-2026-44492)
* automation-gateway: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name (CVE-2026-44496)
* automation-gateway: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution (CVE-2026-44494)
* automation-gateway: Axios: Information disclosure of proxy credentials via HTTP redirects (CVE-2026-44486)
* automation-gateway: Axios: Information disclosure of proxy credentials via redirect flows (CVE-2026-44487)
* automation-gateway: Axios: Denial of Service due to unenforced request and response size limits (CVE-2026-44488)
* automation-gateway: Axios: Information disclosure due to prototype pollution vulnerability (CVE-2026-44495)
* automation-gateway: fast-uri: URI authority bypass due to improper delimiter handling (CVE-2026-6322)
* automation-gateway: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget (CVE-2026-42044)
* automation-gateway: fast-uri: Path traversal vulnerability allows bypass of security policies (CVE-2026-6321)
* automation-gateway: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
* automation-gateway: missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing (CVE-2026-12382)
* python3.12-pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport (CVE-2026-12701)
* receptor: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)
* receptor: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)
* receptor: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* receptor: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* receptor: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

For details about this release, refer to the release notes listed in the References section.

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

Security Fix(es):

* automation-controller: Cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892)
* automation-controller: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
* automation-gateway-proxy: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* automation-gateway-proxy: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* automation-platform-ui: Vite: Information disclosure via WebSocket connection bypasses access control (CVE-2026-39363)
* automation-platform-ui: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)
* automation-platform-ui: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() (CVE-2026-33891)
* automation-platform-ui: path-to-regexp: Denial of Service via crafted regular expressions (CVE-2026-4926)
* automation-platform-ui: Axios: Remote Code Execution via Prototype Pollution escalation (CVE-2026-40175)
* python-click/python3.12-click: Pallets Click: Arbitrary command execution via command injection in click.edit() (CVE-2026-7246)
* python3.12-cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892)
* python3.12-pillow: Denial of Service via decompression bomb in FITS image processing (CVE-2026-40192)
* receptor: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* receptor: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* receptor: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

For details about this release, refer to the release notes listed in the References section.

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat OpenShift GitOps.
Bug Fix(es) and Enhancement(s):
* GITOPS-8784 (Service-CA annotation removed from argocd-server Service during v1.12.3 -> v1.12.4 upgrade path, persists in later versions)

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.19.4 security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.42. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:17446

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/

Red Hat Security Advisory: OpenShift Container Platform 4.18.42 bug fix and security update

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.26 security, enhancement & bug fix update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

* lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Lightspeed in Satellite analyzes system health and configuration by applying  predefined rules to a small set of local data, such as installed packages,  running services, and configuration settings.  When you install Red Hat Lightspeed in Satellite locally,  you can generate Red Hat Lightspeed recommendations without  sending system data to Red Hat services.

Search: CVE-2026-4800