RHSA-2026:67707 - Security Advisory

Topic

An updated OpenShift Compliance Operator image that fixes various bugs and adds new
enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.

Description

The OpenShift Compliance Operator v1.10.0 is now available.
See the documentation for bug fix information:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes

Solution

Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• OpenShift Compliance Operator

Fixes

• CMP-4716 - Bump Compliance Operator Go toolchain to fix stdlib CVEs (net/url, encoding/xml, net/http, html/template, crypto/tls, encoding/asn1)
• CMP-4609 - Contradicting statement Compliance RULE ,about permissions set to 0644
• CMP-4601 - Operator HTTPS metrics endpoint stays dead when it starts before service-ca mints the serving cert
• CMP-4571 - [CO] Switch Compliance Operator base image to ubi9-minimal-pqc
• CMP-4493 - Add NetworkPolicy for Operands for CO
• CMP-4424 - CIS Red Hat OpenShift Virtualization Benchmark v1.0.0 rule content
• CMP-4341 - Investigate kubelet configuration rule remediations for RHCOS10
• CMP-3922 - Broken link for rule "route ip whitelist"
• CMP-3730 - banner_etc_issue has hardcoded remediation
• CMP-3618 - "rhcos4-moderate" remediation leads to "chrony-wait.service" timeouts

CVEs

• CVE-2026-33818
• CVE-2026-46600
• CVE-2026-56853
• CVE-2026-56858
• CVE-2026-56859
• CVE-2026-56860
• CVE-2026-56862

References

• https://access.redhat.com/security/updates/classification/