RHSA-2026:95267 - Security Advisory

Topic

The Tech Preview release of the Sigstore A2A image 0.0.2.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5

Description

The Sigstore A2A image can be used to sign and verify AI/ML workloads

Solution

The Sigstore A2A image provides a Python library and CLI for keyless signing and verification of A2A Agent Cards using Sigstore with SLSA provenance attestations. It lets teams sign agent cards using short-lived certificates from CI/CD OIDC identity and verify them at build or deploy time, with support for both public Sigstore and private Red Hat Trusted Artifact Signer (RHTAS) instances.

For details on using the Sigstore A2A image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index

Affected Products

• Red Hat Trusted Artifact Signer (RHTAS)

Fixes

CVEs

• CVE-2026-102267
• CVE-2026-102268
• CVE-2026-102271
• CVE-2026-102272
• CVE-2026-102273
• CVE-2026-114605
• CVE-2026-63374
• CVE-2026-97687
• CVE-2026-97689

References

• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5
• https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.5/html-single/release_notes/index
• https://access.redhat.com/security/updates/classification/