Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.20.6 security update

Important: Red Hat OpenShift GitOps v1.20.6 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10444 Document as known: GitOps deployment fails as Kustomize 5.8.1 HelmChartInflationGenerator omits SonarQube namespace...

CLEANSTART-2026-WE34008 Security fixes in kustomize 5.7.1-r3

Package kustomize version 5.7.1-r3 fixes 5 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-27137, CVE-2026-25679, CVE-2026-27138...

CLEANSTART-2026-GF33583 Security fixes in kustomize-fips 5.7.1-r1

Package kustomize-fips version 5.7.1-r1 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

EUVD-2026-43087

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175

Spinnaker CVE-2026-55175 affects Rosco/Kustomize bake operations where unsafe YAML tag processing in rosco manifests can lead to remote code execution on rosco pods. Affected versions are prior to 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 across release lines; fixes are available in 2026.1.1, 20...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

CVE-2026-55175 Spinnaker: Improper yaml processing on kustomize bake operations

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pod...

PT-2026-57343

Name of the Vulnerable Software and Affected Versions Spinnaker versions prior to 2026.1.1 Spinnaker versions prior to 2026.0.3 Spinnaker versions prior to 2025.4.4 Spinnaker versions prior to 2025.3.4 Description Unsafe YAML tag processing during Kustomize bake operations in rosco manifests can...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: coder-fips, peerdb-flow, frankenphp-8.3, crossplane-provider-azure-orbital, crossplane-provider-azure-web, aactl, tekton-pipelines-fips, atlantis-fips, argocd-image-updater-fips, ko, kubevela-fips, crossplane-aws-provider, guac, consul-fips, docker, helm,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, terraform-provider-tls, eksctl, chezmoi, nuclei, loki, cert-manager, age, flux-notification-controller, prometheus-operator, sops, cilium, crossplane-provider-azure-managedidentity, k8sgpt, tkn, pulumi-language-java, fscrypt,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: mariadb-operator, flux-image-automation-controller, dkron, ingress-nginx-controller, nodetaint, victoriametrics, envoy-ratelimit, malcontent, supercronic, aws-network-policy-agent, secrets-store-csi-driver-provider-aws, newrelic-k8s-metadata-injection, hubble,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: goreleaser, commercial-chainloop-cli, ko, consul-fips, cloudprober-fips, flyte, tfsec, vault-csi-provider, kiali-fips, dagger, argo-workflows, chainctl-fips, flux-kustomize-controller-fips, falcosidekick-fips, consul-k8s-fips, containerd, packer,...

CLEANSTART-2026-YB46455 Security fixes for CVE-2022-3219, CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142 applied in versions: 5.7.1-r1, 5.7.1-r3

Multiple security vulnerabilities affect the kustomize package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VP44686 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61732, CVE-2025-68121 applied in versions: 5.7.1-r0, 5.7.1-r1

Multiple security vulnerabilities affect the kustomize-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: peerdb-flow, gpu-operator, gitlab-pages-fips, crossplane-provider-aws-wafv2-fips, azure-service-operator, crossplane-provider-aws-backup, flux-source-watcher-fips, goreleaser, tekton-pipelines-fips, zarf, polaris, src, apache-beam-java-sdk, sops, kube-vip,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: peerdb-flow, gpu-operator, gitlab-pages-fips, crossplane-provider-aws-wafv2-fips, azure-service-operator, crossplane-provider-aws-backup, flux-source-watcher-fips, goreleaser, tekton-pipelines-fips, zarf, polaris, src, apache-beam-java-sdk, sops, kube-vip,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, cluster-api, crossplane-provider-aws-kms, hydra, nuclei, crossplane-provider-aws-sns, cert-manager-cmctl, kyverno-notation-aws, flux-notification-controller, crossplane, crossplane-provider-aws-rds, sops, trufflehog, cerbos,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, cluster-api, crossplane-provider-aws-kms, hydra, nuclei, crossplane-provider-aws-sns, cert-manager-cmctl, kyverno-notation-aws, flux-notification-controller, crossplane, crossplane-provider-aws-rds, sops, trufflehog, cerbos,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak-fips, terraform-provider-azuread-fips, goreleaser, aactl, tekton-pipelines-fips, atlantis-fips, argocd-image-updater-fips, kubevela-fips, zarf, image-factory, guac, helm, docker, omnictl-multiarch, policy-controller-fips, sops, packer-fip...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: age, percona-xtradb-cluster-operator-fips, aactl, amass, sops, kots, apko, timestamp-authority, elastic-agent-fips, ksops, gitea, cerbos, argo-workflows, hydra, sqlexporter-fips, certificate-transparency, flux-kustomize-controller-fips, step, rekor-fips, dex,...