RHSA-2026:37286 - Security Advisory

Topic

The Tech Preview release of the RHTAS Model Validation Operator.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4

Description

The RHTAS Model Validation Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20, 4.21, 4.22

Solution

The Model Validation Operator is a Go-based Kubernetes operator for OpenShift that validates AI/ML models and their signatures at pod runtime. It verifies signatures on model and container artifacts before workloads are allowed to run.

Platform Engineers, ML practitioners, and Security teams use it to ensure only trusted, compliant models execute on OCP clusters, in both connected and disconnected environments.

For details on using the RHTAS Model Validation Operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index

Affected Products

• Red Hat Trusted Artifact Signer (RHTAS)

Fixes

CVEs

• CVE-2026-39828
• CVE-2026-39829
• CVE-2026-39830
• CVE-2026-39835

References

• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index
• https://access.redhat.com/security/updates/classification/