RHSA-2026:1017HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.3 security update

Published
January 22, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (6)

CVE-2025-68156 →CVE-2025-13888 →CVE-2025-47913 →CVE-2025-55190 →CVE-2025-58183 →CVE-2025-61729 →

📋 Description

CVE-2025-13888 — openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-55190 — github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:58b596569b8de68d7474d949fd30d9a1666f1f08ea81e8264b9132263b61377b_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:d529b4bbae3cfcf25ea91a29d3c9eb701ef6a3a54e6e0c0117c649f3e4dbe2dc_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:ddc27dbea59c611ffb5394114a6c754397cc0032ba3487a3f03041ed34cfce30_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:f87ac5bb84230c4c34f5404adbc45347a295fb1e60095c2e4ad1e0ea126382b5_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:1ac33bdd539b1bf2033e27f3127badf1afd2d5fdeef9fd51f00feeffdd936f32_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:32ae33eb3d84b30020cb6732e5c84f76cbd2de6abdd7b42e72be887015c49d35_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:a6141b3b5508dc9690ae15ebc3efd33a3fc71382a7dd449a954ffe181f8cd138_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:a621f4cfd83907d57317ce941f470ba4b0fb5d599aab38db936e591dde426404_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:0330e4aab6eb9d7c54417d2a6c5aaf959319eb1c811ab91085570295dc19b258_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:259bb75abc6b464d9badf8b110ab239232152010ada0c407241fab47ecbbae6e_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:571c6d9d4e84c6fcd278e13f15e71b527b618ac7d98c477c516d91e0097ba40c_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:8286093133d109fe0d852491fda66c66d893527f3364c587b6d09823088bcba6_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:0eb572fc96ae2e1973ce43515f03121965600bb09ef0b995eb467f5965c2246c_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:1438757fd131c12d8ae3a1edb5757bc63114b882d00563be2857917611008418_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:a333f6b8ae405b22c746a02bd38a125753a347e7e2c352ec690fa97388b3a40b_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:f8d8f51bd4aeba9dcfd4edad0720410d289ac0e7a2642c90128d506d69d42c77_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:0f883371ffee9d87547a4dc9524a35c5e6cce840a722bf3a01b1be3c1396fdb1_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:6e8d1e3c7bee9c2c2bee357af24bae34510fe6b87075b98f5be34e41dd70d152_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:779c33c3679e47ebca0af343ba6e26d2723cfc9affdcee4df54078ef68278016_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:88d55cc7ec87db114cc60c9c7a67e9c6a69aae69c30a6c076bd94f239a84498c_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:6f16630ff37a5e18b5f8eee782edd6ada351a60b41fdab1bbfda27ebb297135a_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:ae7a2d5c703f6caa7d4facffe3c141bed9739b88967f5a832cf9005b2f815561_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:b6c961fab1178fcc25126ac214d0a7e15bf5738291e2e16c4e05ec320e54fcca_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:bca47a6bb7edb70b24927ea02484c91bc4ce35cc8ebb24f5d68cb28193e77fda_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:792cbe51a6e0f80d9a97b5a6a538a36f756467624144ad3af2c2da53f85db68c_s390x as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:a0236e0cf364d15553a77f0c12f8f8c0bb12ebf2c49c43c68da4f3f28b93e781_arm64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:ab7de39ebdcc363fe61d919ebf430d6e533ddc108075c19f9c9e6d71938bfd6e_ppc64le as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:ed37ac2ef10a9107672556fe62e19020d470745a0ec04378ed840949c49a6234_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:a4e9887db8647c4e958df4725f08340a9c6a462cd18fd2bf9c9f1fc939649740_amd64 as a component of Red Hat OpenShift GitOps 1.18
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (10)