RHSA-2026:26519 - Security Advisory

Topic

The 1.21.2 GA release of Red Hat OpenShift Pipelines Operator..
For more details see [product documentation](https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines).

Description

The 1.21.2 release of Red Hat OpenShift Pipelines Operator.

Solution

Red Hat OpenShift Pipelines is a cloud-native, continuous integration and
continuous delivery (CI/CD) solution based on Kubernetes resources.
It uses Tekton building blocks to automate deployments across multiple
platforms by abstracting away the underlying implementation details.
Tekton introduces a number of standard custom resource definitions (CRDs)
for defining CI/CD pipelines that are portable across Kubernetes distributions.

Affected Products

• Red Hat OpenShift Pipelines

Fixes

• SRVKP-10880 - Custom hub catalog references parsed as URLs causing 'invalid port' error
• SRVKP-11463 - /retest should only re-run failed CI checks, not the green ones
• SRVKP-9474 - Dynamic variable `pull_request_number` is not populated intermittently for push events related to pull-request merge
• SRVKP-9636 - Only one PipelineRun status reported to Bitbucket Cloud for push events (multiple PipelineRuns started)
• SRVKP-9726 - Enable HostUsers Support in Tekton PodTemplate

CVEs

• CVE-2026-27141
• CVE-2026-33186
• CVE-2026-33816
• CVE-2026-40938

References

• https://access.redhat.com/security/updates/classification/
• https://docs.redhat.com/en/documentation/red_hat_openshift_pipelines