RHSA-2026:94583CriticalCVSS 7.5

Red Hat Security Advisory: Important: Red Hat OpenShift GitOps v1.21.7 security update

Published
November 3, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (3)

CVE-2026-75838 →CVE-2026-84445 →CVE-2026-114406 →

📋 Description

CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:09426db30733db5cca8ba4a241cf2f4efbdb4e5c160a614e7a1c933482b8a987_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:753160bd400a1d83939858ce154c4f1900d513d139ecfff26ae996c2b5bed470_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:e3058d4517d8d5e999cfd853583a10800caf18709548b448dc83fde5abc26434_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:fcbad61afde7bd8777fbacc3d6ba26723b98863742e8cbb020be1c7d4d0be7b6_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:5b5c3f393a1661a49abc64939f717c1a027bd343f46ccbfdd2c16245972bb6d9_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:7de722cae86857bd36260b1d6a79c529d35a5b54c892d24847677471b9ef7c49_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:7f4b5fd9fe4edf8b593c9bb82941509c894ac9996b3e8b9c7ddba6d8df3ccba4_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:9f8bbb90fae7fd92e718b7c53cdb85942840bc8ba3a2409160a1fbbe21425f6b_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:0088c73e9c4e2d189cac1f87299aa1b02daa9d06b4fbef9886d0909e7b4faeb3_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:385e5ee8c4c667dab10afd7410179d68bfb63a7309182976cc6b453eb88b4f93_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4cb46c8ee37948985d6d6778c06b83bec31638e93c98769ba65d53ecf1297bbe_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:8ecf16ad90733d7432931a9e42391234708298f23283fcfce41371efb466cb30_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:0b7f6d92c9421d260c378121c7b23669e9fba1ffacc675e1804feabc7690279e_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:34eb45377b3b4cb8e4fb78fec447e3bb28dc31c78c0e7914fc712ff97bf7ad51_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:6dad34363a3b98e055628e06528a9208cae3308319569790bb88c59c239c4e2e_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:da01c5add19772aead04a54af6434e91a7c50fdcac7e0f0364ca2d60fef77622_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:1ae791e9e6d8f53d3b0ff84b9612a8f6692e2903b86af1aa60bc029ad6cab4a7_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:4345b1c97b0aec597143aee0fd16628da10810f0b9f7e0d1261445400aca7a62_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:7d9af3fc3e64723f0e23a2f927fdecd648304c31b85b39d47003c6d58c3d069c_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:fb21bcd34c5cec3bd5b8fd8ed909b363d091c05b2156460a18c49d450591ac08_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:4f186921317d1d7886f7e2569c54ccb6bb73e74a686b5e2b8b79fae46ffdd3aa_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7eaf451ce3ea14ca419fce57ea66e2fad0b1b5771cb5f9b07f713d90b49639f5_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:93dd89449a9fe4e1d9de8b8198386fc1089b808de4304cabbcfdf79a7037bb5b_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:a2d35333b80aef815afd0253ff298b0b204fc646059adf402698ed47c368cb99_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:4e6932c00ea890508bb1b7f15a153a0cad47d4fb12b45ffd4f292a94760ee2bf_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:53ffeafe8934bb8db7749138008785e741a5552464d29f58430dc45977ea6abe_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6e3447aab1e3a4e22e0591de6d56ff23eb7fc1c14f922ecfc8893121ca017a20_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:f36b998ffdd669e3c46df2536f48867312140dce8043977c2b7ceae810036ed2_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:f74d4a9c611292e83f3f55cde1d3146de5e1591924cbbf1cd3370a649840802e_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (7)