[Project Darkstar] PSHP-673: Remediate CVE-2026-45447 in managed-upgrade-operator

[kseiter-rh]

Project Darkstar — Automated CVE Remediation

This PR was generated by Project Darkstar, an automated CVE remediation tool.
For questions or concerns, contact Kevin Seiter (ROSA Trust Engineering).

Summary

• Fixes CVE-2026-45447 (Important, CVSS 8.1) in openssl-libs
• Updates UBI9 minimal base image from 9.8-1782797275 to 9.8-1784092902

CVE Details

• CVE: CVE-2026-45447
• Severity: Important (CVSS 8.1)
• Component: openssl-libs
• Fixed In: 1:3.5.5-4.el9_8
• Fix: Update ubi9/ubi-minimal base image to 9.8-1784092902 which includes the patched openssl-libs RPM

Unfixable CVEs (no upstream fix available)

• CVE-2026-58016 (Important, CVSS 7.5) — glib2: no patched RPM available yet
• CVE-2026-54369 (Important, CVSS 7.1) — libacl: no patched RPM available yet

Changes

• build/Dockerfile: UBI9 minimal 9.8-1782797275 -> 9.8-1784092902
• build/Dockerfile.olm-registry: UBI9 minimal 9.8-1782797275 -> 9.8-1784092902

Verification

• Container builds successfully with updated base image
• No regressions in existing functionality
• Base image update is minimal and targeted (same 9.8 stream)

References

• Jira: PSHP-673
• Parent Epic: PSHP-509
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45447
• Red Hat: https://access.redhat.com/security/cve/CVE-2026-45447

---

Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)

About Project Darkstar

[openshift-ci-robot]

@kseiter-rh: This pull request references PSHP-673 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Project Darkstar — Automated CVE Remediation

This PR was generated by Project Darkstar, an automated CVE remediation tool.
For questions or concerns, contact Kevin Seiter (ROSA Trust Engineering).

Summary

• Fixes CVE-2026-45447 (Important, CVSS 8.1) in openssl-libs
• Updates UBI9 minimal base image from 9.8-1782797275 to 9.8-1784092902

CVE Details

• CVE: CVE-2026-45447
• Severity: Important (CVSS 8.1)
• Component: openssl-libs
• Fixed In: 1:3.5.5-4.el9_8
• Fix: Update ubi9/ubi-minimal base image to 9.8-1784092902 which includes the patched openssl-libs RPM

Unfixable CVEs (no upstream fix available)

• CVE-2026-58016 (Important, CVSS 7.5) — glib2: no patched RPM available yet
• CVE-2026-54369 (Important, CVSS 7.1) — libacl: no patched RPM available yet

Changes

• build/Dockerfile: UBI9 minimal 9.8-1782797275 -> 9.8-1784092902
• build/Dockerfile.olm-registry: UBI9 minimal 9.8-1782797275 -> 9.8-1784092902

Verification

• Container builds successfully with updated base image
• No regressions in existing functionality
• Base image update is minimal and targeted (same 9.8 stream)

References

• Jira: PSHP-673
• Parent Epic: PSHP-509
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-45447
• Red Hat: https://access.redhat.com/security/cve/CVE-2026-45447

---

Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)

About Project Darkstar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• build/Dockerfile is excluded by !build/**
• build/Dockerfile.olm-registry is excluded by !build/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 7e1d76b0-d834-4a07-ba20-c613638918e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kseiter-rh
Once this PR has been reviewed and has the lgtm label, please assign bmeng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[boranx]

/test all

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.