RHSA-2026:8433 - Security Advisory

Topic

An updated OpenShift Compliance Operator image that fixes various bugs and adds new
enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.

Description

The OpenShift Compliance Operator v1.9.0 is now available.
See the documentation for bug fix information:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes

Solution

Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html

Affected Products

• OpenShift Compliance Operator

Fixes

• CMP-3520 - CIS OpenShift 1.9.0 Benchmark Support
• CMP-3974 - Support for Custom Attributes (via Annotations/Labels) in ComplianceCheckResults
• CMP-3993 - Ability to use rules written in CEL to build out of the box profile content
• CMP-4049 - Port customer-requested RHEL node-level compliance checks to the Compliance Operator
• CMP-4108 - Implement support for CIS OpenShift version 1.9.0
• CMP-4112 - File integrity operator does not work with Compliance operator installed
• CMP-4116 - Platform scans timeout when attempting to disable result storage
• CMP-4117 - TestProfileBundleDefaultIsKept fail consistently in CI

CVEs

• CVE-2025-52881
• CVE-2025-61726
• CVE-2025-61729
• CVE-2025-68121
• CVE-2026-25679
• CVE-2026-33186
• CVE-2026-4645

References

• https://access.redhat.com/security/updates/classification/