{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "external secrets operator for Red Hat OpenShift 1.2.1",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66363",
        "url": "https://access.redhat.com/errata/RHSA-2026:66363"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41178",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71556",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/external-secrets-operator-for-red-hat-openshift"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66363.json"
      }
    ],
    "title": "Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.2.1",
    "tracking": {
      "current_release_date": "2026-09-10T22:01:45+00:00",
      "generator": {
        "date": "2026-09-10T22:01:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:66363",
      "initial_release_date": "2026-09-10T08:49:18+00:00",
      "revision_history": [
        {
          "date": "2026-09-10T08:49:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-10T08:49:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T22:01:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "external secrets operator for Red Hat OpenShift 1.2",
                "product": {
                  "name": "external secrets operator for Red Hat OpenShift 1.2",
                  "product_id": "external secrets operator for Red Hat OpenShift 1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:external_secrets_operator:1.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "external secrets operator for Red Hat OpenShift"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
                "product": {
                  "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
                  "product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/external-secrets-rhel9@sha256%3A6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788?arch=amd64\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1788963929"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64",
                "product": {
                  "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64",
                  "product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/external-secrets-rhel9@sha256%3Af369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a?arch=arm64\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1788963929"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
                "product": {
                  "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
                  "product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/external-secrets-rhel9@sha256%3A28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629?arch=ppc64le\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1788963929"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
                "product": {
                  "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
                  "product_id": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/external-secrets-rhel9@sha256%3A6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4?arch=s390x\u0026repository_url=registry.redhat.io/external-secrets-operator/external-secrets-rhel9\u0026tag=1788963929"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le as a component of external secrets operator for Red Hat OpenShift 1.2",
          "product_id": "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le"
        },
        "product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
        "relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64 as a component of external secrets operator for Red Hat OpenShift 1.2",
          "product_id": "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64"
        },
        "product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
        "relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x as a component of external secrets operator for Red Hat OpenShift 1.2",
          "product_id": "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x"
        },
        "product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
        "relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64 as a component of external secrets operator for Red Hat OpenShift 1.2",
          "product_id": "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        },
        "product_reference": "registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64",
        "relates_to_product_reference": "external secrets operator for Red Hat OpenShift 1.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-71556",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-08-07T16:51:14.251077+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512562"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
          "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512562",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71556",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        }
      ],
      "release_date": "2026-08-07T16:37:40.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-10T08:49:18+00:00",
          "details": "Before installing the operator, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images will differ depending on the installation plan approval policy that will be used\nwhile installing the external secrets operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66363"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
          "product_ids": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:28f303432f34c0c60815efb140f2d3d26d1f0e9cd1dcb8246ec9f12944d98629_ppc64le",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6603672dc04b2fbbb3e043e9180da5d83e690865cceb9680ba07c417f4385788_amd64",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:6d3ac3ccefd4ac8c2f25e543718d3dcc8597a64e8a479c1300440abe47388cc4_s390x",
            "external secrets operator for Red Hat OpenShift 1.2:registry.redhat.io/external-secrets-operator/external-secrets-rhel9@sha256:f369f5758ae02eb3bc79cdfc9067f56301e295e329dca2d24a71703582c0295a_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution"
    }
  ]
}