RHSA-2026:90337HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.6 security update

Published
October 26, 2026
Last Modified
November 1, 2026

🔗 CVE IDs covered (2)

CVE-2026-84375 →CVE-2026-71556 →

📋 Description

CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

🎯 Affected products42

  • Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:2759038396205da90b7a1952af34eefdad87b3d4bf830ac9a6a4f2942b2c4bff_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:438790d1ffdfe5277ba985b4c483e35a3a2656d4c42b26eebfdcc60605f2a83d_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:7c2e4bf8757fd3fedbddff40ab58c1fc0da522e1fed6da3c2edc216c5a19db12_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:de9261d376df9009bcfeb44b37de4aabb8f4a9ac5243b6199d3bd33b3712feea_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:0526d72efa2c6a2bd253c6862be593f5a91bc1d97dcc1065077d80584f20dd8a_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:521bf616e37f41080006284360803f05ea9e0ed08f79ae929b34ebf5c757f8f9_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:96acc202f04bcb4400ce7c5c0a3ca294805bdf9dbf98ac86f2de0e08391e3511_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:d333deedf0a6c9e80da3df4ea487e25b784ffcb2af4b7066b2d1bfe1014882f9_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:02e66b6fabf20ed2890ab5df72fbb964efe52de67f2df5a4b5b5b1e060f78de0_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:1711ba52beb36f208c4b8728618af62532c786a2d96069c1572e50fe52ef6cdc_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:7fcf0ee19ad47e8f9f5edb017f02b421b1d6c7a4be186a10419624294cefde77_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:912d47f071d80692676774f2b472c48bfa7486db387be7485a2c3e5d5616f844_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:1d872eef6c383c0b262df634a8e0c5373a7babcbcd889f91586447145d6def46_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:1eed64dd210e2f59ccb5d5dfdc2b6013d38eb09b8ecd74bf3c3f5f41b18d92ff_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:4495608cbd4f210a6da006637af038309068dfbbc4050194981b5538f918ba5b_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8d6af8de8ff2d4fe73d1f1d2eb9007c21535f2b2e1912d1190b76e03ff904c38_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:40c928497d623c6cbe4eaf4c21551496bbfad533f5e81e8f1859e6d91fd0fc7e_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:ae083f48307fb7ced86766aec305d243790b19c1a179b39e256cd471852917df_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c1c4c5eea9d41cbf300757b66687df50f3fcf75a3ae5715c81b1f616cb053a86_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c5206999c0144920a8412c2bd83c4db72b7adcb23286ed55a397abc960ab1973_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:03aa690b5bbd6b617665da47a3d2fcf39ba8633b21b204112e825b39ffe309b7_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:5efe4e2f9c43c23bccc95a264c19ee00f71d01918ea4c351cfdecffa62761b55_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7145d3b966c77904a47c9994d2897b7777cc4db55c0f200d35016baab328db75_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:7c15ef03a1b609907c4380c753cab84262201fe98cb4c643e9cbb7c089db0b56_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:1e60575663a7afac1eba4bad1c9411084a58adaed0bdda982d560fefb7960345_arm64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:54ec9fabb8a21f8a2c2c51b2a4a51e35a2cc23e89c614dcff5e6f07be70bf640_s390x as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:8339244b3b9519f97f0c0993e63fd9ead42ee9dec2ff03780dd7477096ffe6bb_ppc64le as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:c62f6420b0bd0fb3392608df5ff227b0b71551bb1b1f2164d3362f1064164f33_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:09637c340cfc3e6358ce9270eaf4e90752cc631ad5ea299a17de52e1a89657f7_amd64 as a component of Red Hat OpenShift GitOps 1.21
  • +12 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).

🔗 References (6)