RHSA-2026:94581CriticalCVSS 6.8

Red Hat Security Advisory: Important: Red Hat OpenShift GitOps v1.20.10 security update

Published
November 3, 2026
Last Modified
November 7, 2026

🔗 CVE IDs covered (2)

CVE-2026-75838 →CVE-2026-114406 →

📋 Description

CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:0b693bc79a05b251ae6632bfa478cf9544e2529775b4a460dd41ad374a95de83_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:5410e26b787b9fdea5ae863ace9ac5492192d9a308b3e76b1b989afbd243670c_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:ccb86d99423a5af1953ff120a49119cb2f2ebb7a72a0eadbd184ad7b727c65e2_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:f9fb364773de9463e0db1928961dcb5dac8d79f0387148440dcd395c531941fd_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:20fc8e2be55727a37246b28849b283c087f602cf12c7383af61607015541b1f0_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:28acd215b6a4e05ac699e955366b3667d398a4134086fa401476107d949d9018_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:a0e3a6a6a68e7980129e1c1b4351c0ecab558c0812f1e80963bb1ade288bad9f_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:e96e467e6e216d1d24a9fab1e14610dc41f2653e7f0b085f858e8b2758e7699e_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:22237373e8ee0dde3ae06df9c3936ee1e9481f7b9e7f5328fbaf83035ebff8a7_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:c4371e8bab23370b3cd9648ccad182fe66b7ea1011cbc5a0e54d39a829ca3b3d_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:cc24ea9610fee9e4c0b19c0379c2667f4e2e2ae7e0dc9ee56dd952a877a4631b_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:f61961207d15ee5fd2bc148d341ed9538fb02d9f008c7bb4138eb52506d8427e_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:52013e75a383a4bc363d3aaf1ab17726051593c858827d7caf811ed501bd3859_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:547c61abe1c45c77b6864678ec01c0eb7f11cb50c9b972a087deb29d277351a3_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:7f5ea38ddf08c6aa87ef7cd89ffbd6569ec7f5a441c19463a4512126e83f8602_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:ae42ecfc97f0c7e1c7644022b74cb708bfd21f333d3bcfc8bf3a94c0c46bb6d0_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:09b40d9f87258a087ae1fcdfe736ef702415618afb7d6b4c634d95ffd5c120e7_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:45d83108d78748bea39593f03a37afa561725691dae4cbbdcf3eb49cb8a5e8c2_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5609f6d1e0aaeb0c5f0d100eb0bd684ec0531d66c7147f7eeaeacdec0a7a7642_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:771efdff661dc170f5ab191f6c6bfcba59aaf0240e29a823ac905add8ab74257_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:317acd127a1a61244d58ebc79553cd6019f50610b33a657a60a36f3eb8c9392d_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7ec8e63e27ae12367be36ac54e6246c80d930f39f634f27bf60b839e6c4871ef_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:81bdbbef8bbbc26d677793709b112f16020b0f736324d8c6e6a575ddd806ce6f_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:adf1ac252cd3ec2666dcefa473cd669b5d715224a649688d200f03c71c491439_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:31823352765991ad1e4fd5fe34b9efa6a6c8f5efee990f0f886967c098a686fb_ppc64le as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:5a8de0013d92ab09765fb51b7580039f32f5ac2228d4a359524a0deacd01fd4e_s390x as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:c08dfb898951cbcbd0099672e5577dfe86fcf6cb80630493c740edb2f81a1fad_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:dc48e58975826dc0fd5c181a4e055a7bb8c0e6e0793f0e82069863721b780df3_arm64 as a component of Red Hat OpenShift GitOps 1.20
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:0acf5c97844ecdc449cc34afef1da28dcbdd8ae9eef5de4455ef5ad28f9c2755_amd64 as a component of Red Hat OpenShift GitOps 1.20
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)