Red Hat Security Advisory

RHSA-2026:6170

Red Hat OpenShift Pipelines Release 1.21.1

Released 2026-03-30 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Pipelines 1.21 registry.redhat.io/openshift-pipelines/pipelines-operator-bundle

TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433

MEDIUM 44

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02759 Published 2026-02-09 Partial fix · 1.13.5, 0.30.3 CWE-754

TI-2026-25632 CVE-2026-33211 · GHSA-j5q5-j9gm-2w5c

MEDIUM 42

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00583 Published 2026-03-23 Partial fix · 1.0.1, 1.3.3 +3 CWE-22

TI-2025-40928 CVE-2025-66506 · GHSA-f83f-xpx7-ffpw

LOW 38

Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00226 Published 2025-12-04 Partial fix · 1.8.3 CWE-405

TI-2026-25468 CVE-2026-33022 · GHSA-cv4x-93xx-wgfj

LOW 29

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00383 Published 2026-03-20 Partial fix · 1.0.1, 1.3.3 +3 CWE-129