Red Hat OpenShift Builds Updates Address Ten Flaws
Tech GuruQuick Answer
Red Hat has released OpenShift Builds 1.8.2 and 1.9.1 security updates. Choose the maintenance update for the installed Builds stream and verify the applicable running components; this is separate from an OpenShift cluster-version update.
Confirm Scope And Apply The Supported Fix
What to do now: Record the Builds stream, operator/runtime images and build strategies, then apply the matching supported update and confirm rollout before starting validation jobs.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenShift Builds 1.8 and 1.9 |
|---|---|
| Advisory | RHSA-2026:69925 / RHSA-2026:69942 / RHSA-2026:69928 / RHSA-2026:69945 |
| CVEs | CVE-2026-33818, CVE-2026-41178, CVE-2026-56852, CVE-2026-56853, CVE-2026-56854, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, CVE-2026-71556 |
| Authoritative release date | RHSA-2026:69925: 2026-09-22T08:34:04+00:00 (CSAF initial release) RHSA-2026:69942: 2026-09-22T09:07:03+00:00 (CSAF initial release) RHSA-2026:69928: 2026-09-22T08:36:27+00:00 (CSAF initial release) RHSA-2026:69945: 2026-09-22T09:13:07+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69925: 2026-09-22T08:34:09+00:00 (CSAF revision history) RHSA-2026:69942: 2026-09-22T09:07:06+00:00 (CSAF revision history) RHSA-2026:69928: 2026-09-22T08:36:35+00:00 (CSAF revision history) RHSA-2026:69945: 2026-09-22T09:13:09+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled Red Hat OpenShift Builds 1.8 and 1.9 builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | OpenShift Builds 1.8.2 and 1.9.1 advisory-listed images |
| CVSS base score | 6.8 / 7.1 / 7.5 / 8.1 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | The four Builds advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
RHSA-2026:69925 and :69942 cover Builds 1.9.1 and the SSH source-address restriction bypass. RHSA-2026:69928 and :69945 cover Builds 1.8.2 and ten CVEs, including additional Go resource-exhaustion/template issues and go-git file handling. The table retains the combined list without implying both branches introduce the same fixes.
What To Validate Now
- Inventory. Locate Red Hat OpenShift Builds 1.8 and 1.9 deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled Red Hat OpenShift Builds 1.8 and 1.9 builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Move the covered 1.8.z deployment to 1.8.2, or 1.9.0 to 1.9.1, using its supported update channel. Verify operator and build components; do not assume prior build outputs are modified by the tooling update.
- Validate. Check the installed Builds release and deployed image identities, then test representative repository checkout, authenticated source access, build execution and output publication. Track existing application-image assessment separately.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
