RHSA-2026:3296 - Security Advisory

Topic

The Tech Preview release of the RHTAS Policy Controller Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

Description

The RHTAS Policy Controller Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20, 4.21

Solution

The RHTAS Policy Controller Operator is Helm-based operator for deploying and managing instances of the Sigstore Policy Controller on OpenShift. It is a self-managed on-premise deployment of the Policy Controller Helm Charts available at https://github.com/sigstore/helm-charts/tree/main/charts/policy-controller

Platform Engineers, Software Developers and Security Professionals may use the RHTAS Policy Controller Operator to enforce policies on OCP clusters by using supply-chain metadata.

For details on using the RHTAS Policy Controller Operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

Fixes

CVEs

• CVE-2025-61726
• CVE-2025-61729
• CVE-2025-66418
• CVE-2025-66471
• CVE-2026-21441

References

• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3
• https://access.redhat.com/security/updates/classification/