RHBA-2026:92273HighCVSS 7.5

Red Hat Bug Fix Advisory: zero trust workload identity manager for Red Hat OpenShift 1.0.4

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (2)

CVE-2026-33818 →CVE-2026-111943 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products5

  • Zero Trust Workload Identity Manager 1.0
  • registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-server-rhel9@sha256:2bb68dd7352972def4b398b46e0dc06cb56afa9526b47500f1141b5f6da2f6b0_amd64 as a component of Zero Trust Workload Identity Manager 1.0
  • registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-server-rhel9@sha256:54cc171746235c574decd6be2e0de23ff4de72f13bdaca464c16597201c85ab6_s390x as a component of Zero Trust Workload Identity Manager 1.0
  • registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-server-rhel9@sha256:961056685b4f46ac4ff997a94033ea2e359d65cb925214a6b59107e35b89a9a3_arm64 as a component of Zero Trust Workload Identity Manager 1.0
  • registry.redhat.io/zero-trust-workload-identity-manager/spiffe-spire-server-rhel9@sha256:9f6e886624673a89c8b6bdb279843845a88819cb04865651b42d47ae097dcb2d_ppc64le as a component of Zero Trust Workload Identity Manager 1.0

✅ Remediation

Before installing the operator, make sure all previously released errata relevant to your system have been applied. The steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used while installing the zero trust workload identity manager for Red Hat OpenShift. - If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a new version of the Operator. No further action is required to upgrade. This is the default setting. - If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (5)