RHSA-2026:3827HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift Pipelines Release 1.20.3

Published
March 5, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (6)

CVE-2025-11621 →CVE-2025-12044 →CVE-2025-47913 →CVE-2025-61729 →CVE-2025-66506 →CVE-2025-66564 →

📋 Description

CVE-2025-11621 — github.com/hashicorp/vault: Vault AWS auth method bypass due to AWS client cache CVE-2025-12044 — github.com/hashicorp/vault: Vault Vulnerable to Denial of Service Due to Rate Limit Regression CVE-2025-47913 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-66506 — github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token CVE-2025-66564 — github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing

🎯 Affected products13

  • Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:05d553e2c0d86956b32281aa6ae7ffa1948073f753889007f041eb2a72cbfa91_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:1953e97a47dc441f2cd7a2f450aeb5c1792d180539c4756673d0f76679f29da9_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:66be750a2e2abe15579892d3f8d77058d79f165bd60b867a5d37716a277a6b59_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-cli-tkn-rhel9@sha256:9f4bdd415c1e06da1e37e872228e31f4b6ff4890aab7efca0b835ff92ec740cf_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-opc-rhel9@sha256:1f07ea20761776124173a9aab05b072b7ff1de84844a1e9b58cdcbf343ab99e6_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-opc-rhel9@sha256:67e5fd28f10c59bfb6be12fcd3702561b8dc4e6c237a77a38839370d59749154_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-opc-rhel9@sha256:a088a44bb4d11ecf877dc035f351a3500353ec3c8c6a6955d5eb1d6908bf40e3_ppc64le as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-opc-rhel9@sha256:cd4d671c485fe1ffc4fb45734890cb258fddc1658b7e161bee72e1787fd861e6_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel9@sha256:6c868d7ba256b73c66abfb5cbaea0a6d09107c9e90f0deea471d689d1d7bca95_s390x as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel9@sha256:838a518d67dabba6dc212c88c69d8897422f35a5047e82c10fe3830869d98041_arm64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel9@sha256:a5ce1906f4466a88cc0228ab798462120b938622f5ddd89e6826ae3bff968e5b_amd64 as a component of Red Hat OpenShift Pipelines 1.2
  • registry.redhat.io/openshift-pipelines/pipelines-serve-tkn-cli-rhel9@sha256:d17123e7d12d05e7c56cb8cf8c70a0ea2f477b33e529b8db43e3df8b112d353a_ppc64le as a component of Red Hat OpenShift Pipelines 1.2

✅ Remediation

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and continuous delivery (CI/CD) solution based on Kubernetes resources. It uses Tekton building blocks to automate deployments across multiple platforms by abstracting away the underlying implementation details. Tekton introduces a number of standard custom resource definitions (CRDs) for defining CI/CD pipelines that are portable across Kubernetes distributions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

🔗 References (10)