RHSA-2026:74791 - Security Advisory

Topic

Gatekeeper v3.20.1

Description

Gatekeeper v3.20.1

Gatekeeper is a validating webhook with auditing capabilities that can enforce custom resource
definition-based policies that are run with the Open Policy Agent (OPA). Gatekeeper is supported
through a Red Hat Advanced Cluster Management for Kubernetes subscription.

There are new parameters for the operator configuration, starting with version 3.20. View the following parameter descriptions:

• `mutatingWebhookConfig`: Use the `mutatingWebhookConfig` parameter with the `webhook` parameter for overrides and configurations specific to the mutating webhook. The mutation-specific fields in `webhook` are deprecated.
• `timeoutSeconds`: Use the `timeoutSeconds` parameter to customize webhook timeouts.
• `rules`: Use the `rules` parameter to customize the requests that are handled by the webhook. Unlike other fields, the `rules` parameter values are specified separately for validating and mutating webhooks. Setting the `rules` parameter overrides anything that you set in the `operations` parameter.
• `podAnnotations`: Specify the `podAnnotations` in `spec.audit` or `spec.webhook` to set deployment-specific annotations.

Additional release notes:

• Open Policy Agent Gatekeeper v3.20.0: https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.0
• Open Policy Agent Gatekeeper v3.20.1: https://github.com/open-policy-agent/gatekeeper/releases/tag/v3.20.1

Solution

For more information, see the following resources:

Documentation

• Open Policy Agent Gatekeeper documentation: https://open-policy-agent.github.io/gatekeeper/website/docs/
• Red Hat Gatekeeper Operator documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/governance/gk-operator-overview

Support and troubleshooting

• For support and troubleshooting, Gatekeeper is supported through a Red Hat Advanced Cluster Management for Kubernetes subscription: https://access.redhat.com/products/red-hat-advanced-cluster-management-for-kubernetes
• The Open Policy Agent Gatekeeper community collaborates on Slack. Join the #opa-gatekeeper channel: https://openpolicyagent.slack.com/archives/CDTN970AX
• Open issues on the Gatekeeper GitHub repository: https://github.com/open-policy-agent/gatekeeper/issues

Affected Products

• Gatekeeper

Fixes

CVEs

• CVE-2026-32280
• CVE-2026-32283

References

• https://access.redhat.com/security/updates/classification/