{
  "document" : {
    "aggregate_severity" : {
      "namespace" : "https://access.redhat.com/security/updates/classification/",
      "text" : "Important"
    },
    "category" : "csaf_security_advisory",
    "csaf_version" : "2.0",
    "distribution" : {
      "text" : "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "en",
    "notes" : [ {
      "category" : "summary",
      "text" : "The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
      "title" : "Topic"
    }, {
      "category" : "general",
      "text" : "The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20, 4.21, 4.22",
      "title" : "Details"
    }, {
      "category" : "legal_disclaimer",
      "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
      "title" : "Terms of Use"
    } ],
    "publisher" : {
      "category" : "vendor",
      "contact_details" : "https://access.redhat.com/security/team/contact/",
      "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name" : "Red Hat Product Security",
      "namespace" : "https://www.redhat.com"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "https://access.redhat.com/errata/RHSA-2026:50874",
      "url" : "https://access.redhat.com/errata/RHSA-2026:50874"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
      "url" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
      "url" : "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/cve/CVE-2026-42151",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-42151"
    }, {
      "category" : "external",
      "summary" : "https://access.redhat.com/security/updates/classification/",
      "url" : "https://access.redhat.com/security/updates/classification/"
    }, {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50874.json"
    } ],
    "title" : "Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release",
    "tracking" : {
      "current_release_date" : "2026-09-24T19:16:56+00:00",
      "generator" : {
        "date" : "2026-09-24T19:16:56+00:00",
        "engine" : {
          "name" : "Red Hat SDEngine",
          "version" : "5.4.0"
        }
      },
      "id" : "RHSA-2026:50874",
      "initial_release_date" : "2026-08-05T17:56:26+00:00",
      "revision_history" : [ {
        "date" : "2026-08-05T17:56:26+00:00",
        "number" : "1",
        "summary" : "Initial version"
      }, {
        "date" : "2026-09-04T00:36:24+00:00",
        "number" : "2",
        "summary" : "Last updated version"
      }, {
        "date" : "2026-09-24T19:16:56+00:00",
        "number" : "3",
        "summary" : "Last generated version"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_name",
          "name" : "Red Hat Trusted Artifact Signer 1.4",
          "product" : {
            "name" : "Red Hat Trusted Artifact Signer 1.4",
            "product_id" : "Red Hat Trusted Artifact Signer 1.4",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            }
          }
        } ],
        "category" : "product_family",
        "name" : "Red Hat Trusted Artifact Signer"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64",
          "product" : {
            "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64",
            "product_id" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/createtree-rhel9@sha256%3A67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a?arch=amd64&repository_url=registry.redhat.io/rhtas/createtree-rhel9&tag=1785391426"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "amd64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64",
          "product" : {
            "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64",
            "product_id" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64",
            "product_identification_helper" : {
              "purl" : "pkg:oci/createtree-rhel9@sha256%3Ada3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c?arch=arm64&repository_url=registry.redhat.io/rhtas/createtree-rhel9&tag=1785391426"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "arm64"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le",
          "product" : {
            "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le",
            "product_id" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le",
            "product_identification_helper" : {
              "purl" : "pkg:oci/createtree-rhel9@sha256%3A4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc?arch=ppc64le&repository_url=registry.redhat.io/rhtas/createtree-rhel9&tag=1785391426"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "ppc64le"
      }, {
        "branches" : [ {
          "category" : "product_version",
          "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x",
          "product" : {
            "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x",
            "product_id" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x",
            "product_identification_helper" : {
              "purl" : "pkg:oci/createtree-rhel9@sha256%3Af159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9?arch=s390x&repository_url=registry.redhat.io/rhtas/createtree-rhel9&tag=1785391426"
            }
          }
        } ],
        "category" : "architecture",
        "name" : "s390x"
      } ],
      "category" : "vendor",
      "name" : "Red Hat"
    } ],
    "relationships" : [ {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4",
        "product_id" : "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le"
      },
      "product_reference" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le",
      "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.4"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
        "product_id" : "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64"
      },
      "product_reference" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64",
      "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.4"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
        "product_id" : "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64"
      },
      "product_reference" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64",
      "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.4"
    }, {
      "category" : "default_component_of",
      "full_product_name" : {
        "name" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x as a component of Red Hat Trusted Artifact Signer 1.4",
        "product_id" : "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x"
      },
      "product_reference" : "registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x",
      "relates_to_product_reference" : "Red Hat Trusted Artifact Signer 1.4"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-42151",
    "cwe" : {
      "id" : "CWE-256",
      "name" : "Plaintext Storage of a Password"
    },
    "discovery_date" : "2026-05-04T19:02:26.983660+00:00",
    "ids" : [ {
      "system_name" : "Red Hat Bugzilla ID",
      "text" : "2466507"
    } ],
    "notes" : [ {
      "category" : "description",
      "text" : "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
      "title" : "Vulnerability description"
    }, {
      "category" : "summary",
      "text" : "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
      "title" : "Vulnerability summary"
    }, {
      "category" : "other",
      "text" : "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
      "title" : "Statement"
    }, {
      "category" : "general",
      "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
      "title" : "CVSS score applicability"
    } ],
    "product_status" : {
      "fixed" : [ "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x" ]
    },
    "references" : [ {
      "category" : "self",
      "summary" : "Canonical URL",
      "url" : "https://access.redhat.com/security/cve/CVE-2026-42151"
    }, {
      "category" : "external",
      "summary" : "RHBZ#2466507",
      "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
    }, {
      "category" : "external",
      "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-42151",
      "url" : "https://www.cve.org/CVERecord?id=CVE-2026-42151"
    }, {
      "category" : "external",
      "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
      "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
    }, {
      "category" : "external",
      "summary" : "https://github.com/prometheus/prometheus/pull/18587",
      "url" : "https://github.com/prometheus/prometheus/pull/18587"
    }, {
      "category" : "external",
      "summary" : "https://github.com/prometheus/prometheus/pull/18590",
      "url" : "https://github.com/prometheus/prometheus/pull/18590"
    }, {
      "category" : "external",
      "summary" : "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
      "url" : "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
    }, {
      "category" : "external",
      "summary" : "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
      "url" : "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
    }, {
      "category" : "external",
      "summary" : "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
      "url" : "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
    } ],
    "release_date" : "2026-05-04T18:12:16.917000+00:00",
    "remediations" : [ {
      "category" : "vendor_fix",
      "date" : "2026-08-05T17:56:26+00:00",
      "details" : "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
      "product_ids" : [ "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x" ],
      "restart_required" : {
        "category" : "none"
      },
      "url" : "https://access.redhat.com/errata/RHSA-2026:50874"
    } ],
    "scores" : [ {
      "cvss_v3" : {
        "attackComplexity" : "LOW",
        "attackVector" : "NETWORK",
        "availabilityImpact" : "NONE",
        "baseScore" : 7.5,
        "baseSeverity" : "HIGH",
        "confidentialityImpact" : "HIGH",
        "integrityImpact" : "NONE",
        "privilegesRequired" : "NONE",
        "scope" : "UNCHANGED",
        "userInteraction" : "NONE",
        "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
        "version" : "3.1"
      },
      "products" : [ "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:4425002ad8b0a88bf0b276798b489fd2eb27937bfd1fee8cb30faa5e7436e4bc_ppc64le", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:67ffc065718d8937fd5763b712f89f2c720e3b6936852e8360e395bfea49c28a_amd64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:da3b159bde293bb7f19ec0a29405e58c4cd708abadddd017487ebe919979830c_arm64", "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/createtree-rhel9@sha256:f159e250d6d60eb672f9ce0ad46fc97e35bd0e9bc7e24530ff1efc64979e80f9_s390x" ]
    } ],
    "threats" : [ {
      "category" : "impact",
      "details" : "Important"
    } ],
    "title" : "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
  } ]
}