- Issued:
- 2026-07-06
- Updated:
- 2026-07-06
RHSA-2026:35995 - Security Advisory
Synopsis
Important: Red Hat OpenShift GitOps v1.21.1 security update
Type/Severity
Security Advisory: Important
Topic
Important: Red Hat OpenShift GitOps v1.21.1 security update
Description
An update is now available for Red Hat OpenShift GitOps.
Bug Fix(es) and Enhancement(s):
- GITOPS-10083 (RC 1.21.0-7: Missing permission for web-based terminal in Argocd UI)
- GITOPS-10178 (OpenShift GitOps operator v1.21.0 breaks Redis-HA replication when upgrading from v1.20.4)
- GITOPS-10273 (GitOps Operator metrics alert after upgrade: ServiceMonitor expects HTTPS but metrics endpoint serves HTTP on port 8443)
- GITOPS-9971 ([Image Updater] Self-hosted Quay images redirect to quay.io, not self-hosted URL )
Solution
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
Affected Products
- Red Hat OpenShift GitOps
Fixes
- https://issues.redhat.com/browse/GITOPS-10083 - RC 1.21.0-7: Missing permission for web-based terminal in Argocd UI
- https://issues.redhat.com/browse/GITOPS-10178 - OpenShift GitOps operator v1.21.0 breaks Redis-HA replication when upgrading from v1.20.4
- https://issues.redhat.com/browse/GITOPS-10273 - GitOps Operator metrics alert after upgrade: ServiceMonitor expects HTTPS but metrics endpoint serves HTTP on port 8443
- https://issues.redhat.com/browse/GITOPS-9971 - [Image Updater] Self-hosted Quay images redirect to quay.io, not self-hosted URL
CVEs
amd64
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:93e97ca5581d02b0de8cdc36474be8cb7cec66451995e7c4b2d502105e91647b |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:2c9f4259f578aa7908a1e78018bc7f4c13d3db191a9b0fe0c17473d026662d96 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:ebd165eddcb23a4dbb10839e45702b4f35a163dab163e81fd6e6b6f6c9b4d688 |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ea80f43122a94d8999f865bc094faea29d10d8fcec213f6946c794c35ad6496e |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:23490cf4c16b8fe704e1491f1a3c91058a431655d3919dc2ae628393b2237d35 |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:9ce6b4b8884db21d040222b2d2316ed5afdfab032e3f39af85071e103ad27e87 |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:343f88458f9a5c92d71b3ef79645126feac8b9979dfa1c0cc95eaa0fb3e2b5a8 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b2e1ff63531d5e04307c5f66b753af3accd70ce8b9e0438b803aa525c2c006bb |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:d1443b6fc4be75f936c060ec1cb795ac59184936807178832bd221a08234dd32 |
| registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:43e18d5224a339cb688dfc50b733b7fb8cbdc394ba9e4eefc7988020fe75d1ca |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:f52f0fa6a4c47d1256bade16066d03cb81c9eb0c01a26acfee6044017683d6eb |
arm64
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:78c4eaef53bfe440e55df7dc0d05ef1287027232d833c3f138464af9b91f6142 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:b7415899816317141f2776ddc39d5e9aba914e82af7120c9d9cdd562f6c2dbe6 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:9afbe63f4517ebfbd9208dcca961ff70889e4d1567465e0cdd77c66fb8ee10b6 |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:bc170d2092e96f2ac974d4825a009cd1425478b035f51671d257be731821dc67 |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:e2a14e735bcdf78358063ae3427e5c527888628252d999c98eac8b026dd584da |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:3ea9fc9b41065159786052de33a7144c7508a3a3945431e3465e614e8e8a838d |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6e0cf94f5e0e4cdbbde4d44a37693625c804f81518ffa342b5223ddd0ebb03b0 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:a0b0a6e0d62761e4b7ad379961bb8ac854a1cf68771acfceb4aa2bdf07b7c0b6 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:34c840201213f42f42e310cf889e6bdeb76e10ac02d18bc86d97b2707b317ce7 |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:e5ed2b02712ed5ddad329df0ce1f4ee7856c09537297e68bdeb3e8b3d0f27b7e |
ppc64le
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:31df9ed78ef673c141f895b5da9fc88ed390d9cd025b1a42c7ce6d483ea827f0 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:63a9dbce99c6324d926f0ca75f6f6110a7d18cb9076a9a628b08aaa35d2b36d5 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f7400956c57376901995ee80dd360aaf3bfc72c3ed0182e155af9d926bf33f05 |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4507a756880f88e7c59552dd035ee3ccab7491596c5644a594a1b02d1b6d6ff8 |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:78be21366d4a67ae22242a9a3e996bf57581311bd52a8a40210504b5c961afc1 |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:38d0b6127b62d08834018556ab9d36d7938f273f10bd0e618d1bc6db555922c1 |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:3b9992666638d4a3a66f635be54e576420b7c5bf73c6ee5a45a6fe8f9ed94531 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:7baffc0e9bb45512eb6d95ad7d885c0ac74d3be28c0f8f24d48b5e5e11f46501 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:a6c352ac19baaac3ebe76a1a3ebbf024a6283a8a52dacc29ca287f1d4ecdbb97 |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:fa543e276e0765cb03afb83aa37da65d7e709846606028116c2999f73ec6f5e4 |
s390x
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:66f7b0cae096b5062eff698c507fd25cf0718a434cdfd56851c7ee844de3f361 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:9ffea8bd1cec5f6667b7af31f33c94f40413431c5b3d6918e5db628751ea6ec9 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:9b7c41fc354b824f832ece7d9bf75080cd79170f7bfff6adeda81fc4d12a8021 |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:2de4f9045e40718b6243ca2d19964c9e300d2fc5e6f73d98b2d326a68f2ba701 |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8a5aea72d9d5e325c07bf42b335b3a9fb7e330c93bd0accf7adbc4fde1fa0f3f |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:056a29a0bf815d8a3525597b7ac6458077f28596704ead6238a6e4f4e18ca5d4 |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:1e13472d3cc29e80fbc2d517e1605dc670ea2b32e93f9e5e633e572ad534638f |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b6d45f8851b48363458e8c25a9e816ab7d81f2b2568fae587b16cafc5cfe0ea6 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:ebe8a468331014b469c75d41d1eea507fe2e29dfcb4f71b432b1c2358b88ee42 |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:75d9535ee698cd9b3f55cd80d33a57d949df2186d19caf28427d31d75794d000 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
