RHSA-2026:2922HighCVSS 7.5

Red Hat Security Advisory: RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release

Published
February 18, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (5)

CVE-2026-22772 →CVE-2025-47913 →CVE-2025-61729 →CVE-2025-65945 →CVE-2025-66506 →

📋 Description

CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-65945 — node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2026-22772 — fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation

🎯 Affected products6

  • Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/cosign-rhel9@sha256:8efb2c8f77e91d7a15063ddc6f7eca1226a494f0f9340590af6e3a2eb9c462c3_amd64 as a component of Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:e001128c079f0355e88161c08f092d0d5b0d2f984fdb672002d4bcddf9585cd5_amd64 as a component of Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/gitsign-rhel9@sha256:4c59990381ce313cd845257e95fd2e910b3d84459c5b3c3aa09fce954a328101_amd64 as a component of Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:6dc1b8af2586c0b7dc2786ed075f3e387943bed78818e02c7bd38f0ac1cace0b_amd64 as a component of Red Hat Trusted Artifact Signer 1.2
  • registry.redhat.io/rhtas/updatetree-rhel9@sha256:cfba6d424b5e45362bb4e61d9b05bb49a24beb56a3c5ddc3aebdd2e0647179de_amd64 as a component of Red Hat Trusted Artifact Signer 1.2

✅ Remediation

Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2 You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (10)