RHSA-2026:1018HighCVSS 8.8

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.17.4 security update

Published
January 22, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (6)

CVE-2025-61729 →CVE-2025-68156 →CVE-2025-47913 →CVE-2025-55190 →CVE-2025-58183 →CVE-2025-58754 →

📋 Description

CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-55190 — github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68156 — github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:04a0309f1ea64b27a03d51ed435e3ba03b9b1c00f92ef1d136db7873be49bf6c_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:42bcfb29916b6c0ed25625841c9dd483b1a36cd978c6815a2969a794417474b0_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:5cd9912e51ffea57bad97d8d725cd6210c0ba43d41d6a11c67b03d7e8807a1b4_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8@sha256:c1061a246650fe9735d3c5b439fb81e859e5badcd69c4ea241204287e14ec802_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:309b422848a3c58a2f6716b2ae7891fae31a2bee824dddf2206d3ee4d9c0e3be_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:38252c3097bc6ac5971aff8ca9c9280a5569b8824a96034cddeff4a2feed9354_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:8a07b1dcc21b99093a21936da2959f4ff9dbe9b2a138609594ec1cbfab06d096_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8@sha256:a922ecfd9f8d0cbc42897871235789c5f60dfeef43487697152acd492da2ba52_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:221e413f5a21ae4a8eb3a92c88a0f901980fb022f43c5c9dd0b618cb8d94f12f_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:6dbc097f05deedeb5a1242bcbbbd71a32f7280e60d65ba0773b36f83b98bcd31_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:752863bfda3f6021ffbb356696049b7983dec9556da06f2c5e653fa9244a2b25_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel8@sha256:95db3bb5baeea65a0304c1701ae7f84b9431fc1f13f7c18085abc82d5a7eace1_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:0afd39c2275c46025cee7518d62cc3a26441758f9315e864d25f8b78a5e464f4_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:1f93ea9508e4f1a9c54158d8fa6a0dc7babb65fcbd606c3474fd953fc80e95c9_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:7bec6ba526ade9f626672e69d9b4a22df5a4d5d6b65a3d7fd681055968e85db8_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel8@sha256:f5b3f576f18c0687c5cb757d8c7420ca883033975b906cd2c6fabace582a7fdd_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:19ee8d67235801b83af21c52b92b0855e34f959700eb400d2db455a50b91f512_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:2946fd417176936f3339cbbb3597d45f586357e68810d8449e716fb827f5debb_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:8019ec0d2ecc069941d771369cd072c656532aa7bff4a15ba0f62e4d0545992e_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:80f845196a254e186385aa8c0217bfd857a1832357bc309875b6b82a835eadee_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:54cf6dad43d830b530b6554c25f24b23be3bb51fc9436b20fc4c75fa03665b84_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:81f57cf09f298ba6436d9f3236d53210de456b8b1e54b565788b15b7a9d48411_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:cf87bc59b51519af1fb349291dc6e0e346c22db132ab8ed2b0efd49e2a1f9775_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel8@sha256:f626986471cf481e3101377242474d3904439fa12ed45b9dd49cb1d369390c65_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:072fc7738b1bd7fdfacc99eafc7fe55dfa3ebfb79466f255401b821391667971_s390x as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:495cfc1e0b1112d6d534baacda0d5591b67af1123b7099a65514365226b8874d_ppc64le as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:b5ef707dee8e0098612e5117b8e5baaebb959c75a0416624d727dd44106c401b_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/dex-rhel8@sha256:c89915b32d7812867b049c754480667c6218738d81fceb7012a615928508d62d_arm64 as a component of Red Hat OpenShift GitOps 1.17
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:710f6fe3896177cae0d900643b7147d11410e5e58ee012e139fbeee308ee297b_amd64 as a component of Red Hat OpenShift GitOps 1.17
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, applications using the `Expr` library should ensure that evaluation environments do not contain cyclic references. Additionally, externally supplied data structures must be validated or sanitized before being passed to `Expr` for evaluation. As a last-resort defensive measure, expression evaluation can be wrapped with panic recovery to prevent a full process crash.

🔗 References (10)