RHSA-2026:51084HighCVSS 8.8

Red Hat Security Advisory: RHTAS 1.0.2 - GA Release Of the Policy Controller Operator

Published
August 6, 2026
Last Modified
August 18, 2026

🔗 CVE IDs covered (2)

CVE-2026-25681 →CVE-2026-53488 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

🎯 Affected products3

  • Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/policy-controller-operator-bundle@sha256:b5c08c17bd9c60a295f9e557371da76d5bad9e87071c478e4caef82fefc375fd_amd64 as a component of Red Hat Trusted Artifact Signer 1.4
  • registry.redhat.io/rhtas/policy-controller-rhel9-operator@sha256:f2fbc563cd7a9f63dbf516265cda7a9a855682856fa799b831ee6e12b7d6332d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4

✅ Remediation

The RHTAS Policy Controller Operator is Helm-based operator for deploying and managing instances of the Sigstore Policy Controller on OpenShift. It is a self-managed on-premise deployment of the Policy Controller Helm Charts available at https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller Platform Engineers, Software Developers and Security Professionals may use the RHTAS Policy Controller Operator to enforce policies on OCP clusters by using supply-chain metadata. For details on using the RHTAS Policy Controller Operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (6)