RHSA-2026:90323HighCVSS 7.1

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.9 security update

Published
October 26, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-71556 →

📋 Description

CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:525ed2c85746300276659cd92679a78f9fc42c122e55ff328674e2354ba452ad_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:a344efac20f0f2f1769980900cf19afbf2980f11e6a641e8c4b488557ee8939c_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:a9db60fa1586021acf17bfde92725590814374cc0df35c27884bb7c0795bf929_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:c48538aea8a57c344bb2ead9703930cfacf1c3629fd597cb3408d170f4326a32_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:05388d001c6a64044069de29943cc2a32cb06d2a994807207d094b8e2f9d75cb_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:09963981356c609cfe9431ff47c86b049ac24b77551099fd058c491f160fa07c_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a5206c510ca0138916edaf71fe102cd3c56470103bbe4b6a7e2f33b0f20ced41_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:ef85a982bb8cba45123b745e8a63f2f4b81532da86a74226b1dc726165bd75b1_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:703910b317fb3432250f995fe301f5e6c83c487b985392cb7347a9e2873c08f9_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:cc5db039c38d0b0b4006651f3c4f6f392de4db369b56654698828990a2a4abb6_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:dea2f730c66d18415723603e5f668f88d0df8da43875437631089c955b8556a3_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:eaad816c25ff6642fd05059632ba0ebfc7834bf63334326dd8e287e699d6992b_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:1cef96afd6e8ea6acf2c3c8d7b72c0179399897b172e58caa23981e49e8e8db2_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:38ad7e819d8c0d159c1aa33cf42923c0ef4760dd57f1bd3cf395de7b1718e41b_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:479c1345117f72c672a244872816a1340f52a748b925014bcb11c0c0a9cd6052_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:f51f48fdbaf708c88cef27530ffaca055685f59c0ab4af7c9334fff966715127_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:0ad6f243c58401d2d5595ae948966ade9f3fd6de96481a89cb1215d2aa9b2112_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:82b003bcdfaee7317df64a27da3646b791ab10d3658d50c1e62bf4e24b193cf4_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:8cbba3b3c4bcb2469ae11f84c5ac473c27af05ac1473004cf509c03d324ecff3_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:fc94a822ab7401258e02a1dd47c96525d700998b81c1b9af18f83c734f9f2bab_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:10850f6c444184237a28bb151ba321b2bbd80c74c996acd1f76cce9023b91a70_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9726c9ea4e7465db945bbe2f93984c054179be3b31e6f10f90e251d6ba28e457_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:faff652f98e90ec79f4043b3fdfacc63c4bc9800159fb4f7f8569cd6eb661d66_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:fd5936a5a9921d8e5137cfa622ca30a9efe5f8f52be461e4bb27b91cd12d4e6a_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:3298f57f32220d3b2edd4310fd9aa37feb9650c2254f4c5493177bc86c04bf70_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:429294d371842cf9d7496e059dc90e41d1bd484fcbe8e52b9caffced30d7ffb7_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:95a5e6d541e3a65f740d08335283e57dfb8759284b43a96d359ca028847ae5b0_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f21c9e87bef191d1349a719399f0e38d3d69ae2d136812c3e8e3b0a33b79441c_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:56d79517af6478c954f5349867d566d55e50cd1764bfa5344f1c25a5b7fcabc1_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (5)