- Issued:
- 2026-04-22
- Updated:
- 2026-04-22
RHSA-2026:9699 - Security Advisory
Synopsis
Important: Red Hat OpenShift GitOps v1.20.2 security update
Type/Severity
Security Advisory: Important
Topic
Important: Red Hat OpenShift GitOps v1.20.2 security update
Description
An update is now available for Red Hat OpenShift GitOps.
Solution
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
Fixes
- GITOPS-9158 - OpenShift Gitops Operator v1.19.2 has hardcoded pod-security labels which conflict OCP <= 4.16
- GITOPS-9511 - ArgoCD SystemCATrust breaks repo-server init
- GITOPS-9587 - multiple CVEs in ose-kube-rbac-proxy images included in OpenShift GitOps v1.19.2 and v1.20.1
CVEs
amd64
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1f376f53aa7d80bf48b61314480596b4837a9c80a0bbbefb428dc24ad74a6126 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:c7fc5b1653c5d8175d480481d44e797aa843a10a4eae753a7eb70a5871540ed8 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:b7e423bf7fde922a1d8fe4adf6f5205fc4908881f496e6ebd05db0b5f890d35c |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:ddd9d15f0962e166d5e2ca0797137a135f34c558a5a51ac85a173f245d763625 |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:fde967c5f4e625ad901ff3635f7a9cd0e9db64dfff9083618e3d793e21e8488f |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:1bbc1efa6478d85935146b7c50217204094e0c07a3d096f353567cc4aec7b7af |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:b61518708f23cf947a447823c7747167259faddbd8032a3c8596c8fa9d5b84af |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:07f30eba3f93a9e1605c27aeab76f195829443b9d454a2e8d2d5938806f165b1 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:6aaaf3f027d5d673b70a1a5d4276416e3525e6249947b4a631df4c63856acd63 |
| registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:247a54db35e184702d9c1d6f83cd9e3669f8aae48bd0eeaecdbeeda6176c525f |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:a6596a7bcceb01a55db1f2ad9894ec8550cf4a6d9fc5976d9082684863f0ff8d |
arm64
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1a8c1669907826bf3f711845c6d4833b2e2c5c4807bada9797b9b0d6397955b7 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:65049e2c8984f2f08c05838a407b4641285c956c440f700225bdbf67cf03c8bc |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:f3b25a4b791a6d75c2bb7fa156fa5796ca0ef7e3520c432cd1e0ee094b0b44ca |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:a87ae94bb4eeaf8e00e5b60639ce8a74af2fa74d5312f1586db65ac2e7e3915e |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:13348eb0e7ca8a4517becd8f6feae39f26bca07e47568699c153747568f89c3e |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:e0d9a33cca85c936439e04862ecec780554cf34e9c6df7f62497595d61e8c1e8 |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:feaaf37afd8ccab9460c39606164fbc93cdc4d60eab68e5809465e9aa484e0bf |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:b406493693fdae121f128e9a18b4139a05f5e682fd8dacfa3e8fe7c6b35bcfbd |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:6467e7ef9afeb8c45da2620221257751ae2c0f20019cad986e3bda5176287321 |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:9bbdc7456e80ff7adc21ee179f2ad678131b700a30f467e9cae98f52fcc1a866 |
ppc64le
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:1eb9a401a5e48ee2536b8d869b23ec28e10452d37160740db3a09dd7f2c9e357 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:627f071531fb4da783c4f231fa3afd26d9eb9a56dc51b5d55a742f167b36d2f9 |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:46c6c393d217df1c645c06d0da7ac1e82defc4ee1d773b6e288c976cdfaf1f89 |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:4df95769cab0fd8fdc88f79857a7ace2fd0183fdc7ace73db480aa9de0d2d0af |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:8b19c499ebb9feeb664ff3721bdc2170fd62a21cc9f5c84d9ff10cd0a71030e7 |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:c01ac978ee2e58f675e45b39d13a643ceef4fb89cef6438a5be4a2bc3a1c6efa |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:a3996e99a9ebe783373b78f352e5c77970e66546e888bce3bc9a02594bd37ad3 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:7548ae87b7645ab79259a3e6603b471432a322d2a46d233f653c25cb8755a33d |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:aec32824bc31c868f8b40612f4e99ab9953458a4b550bb0323ff4173ebd21f53 |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:81de8e9723ec5819ecf40a8abac1218d3ca23f65db824996e697c3f5eb1c88ce |
s390x
| registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:322f13074a5f64ec486e52416112a4ce63c6fce9c21443b9909343f1391613b7 |
| registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:8596b4e5df8abf7771e6da9920d25186facd7bef39dc553c1e479b3ef1a9e8cd |
| registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:09708d69743cbc7981ffa823dbdc782b0fac0b577ad6cecc4b875dd712a0c6dc |
| registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:96b8cc9a32104c7262aabc79dc01489640378717cd75d33c0aaca165ff193b2e |
| registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel9@sha256:9933d9dfafd4c1085a58e305b187386b3ea3f751a483c811a81b7f3ffd31c738 |
| registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:26192e97d753181a1b7cb7baf0ec130c1592151c9a46c1940c42e80267df2486 |
| registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:0882d236e8887a0467687195620419c72c5064ca518b9f54d7a30dadbcc49726 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:122e412e01acd1a6a67b07364e280545b356488de9e1874cbff0a2a72a958525 |
| registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator@sha256:6c2e60047d0f6015418fc06e04bc6a02ada0640f27d10e09a2d3f21eba3bef6d |
| registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:ae636a937c42bce533a4e12929e0fc92f175f89be10e2857e2ce1287e1930bf1 |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
