Please fix high-sev CVEs in ansible-operator:main image - blocker for RH operator certification

[vlella]

The ansible-operator:main image currently has 17 High CVEs, which is a blocker for our Red Hat operator certification.

Please update to clear them. Image and full scan:

• Image: https://quay.io/repository/operator-framework/ansible-operator?tab=tags&tag=main
• Vulnerabilities: https://quay.io/repository/operator-framework/ansible-operator/manifest/sha256:7aff62c931d222a87bcb35bef80652aa526e237cc66592a72f4552336a0ca03d?tab=vulnerabilities

High CVEs to address:

#	CVE	Package
1	GHSA-537c-gmf6-5ccf	cryptography
2	CVE-2026-40356	krb5-libs
3	CVE-2026-45186	expat
4	CVE-2026-45447	openssl-libs
5	CVE-2026-4519	python3.12
6	CVE-2026-6100	python3.12
7	CVE-2026-4786	python3.12
8	CVE-2025-59375	python3.12
9	CVE-2026-4878	libcap
10	CVE-2026-4519	python3.12-libs
11	CVE-2026-6100	python3.12-libs
12	CVE-2026-4786	python3.12-libs
13	CVE-2025-59375	python3.12-libs
14	CVE-2026-33846	gnutls
15	CVE-2026-42009	gnutls
16	CVE-2026-42010	gnutls
17	CVE-2026-33845	gnutls

Thanks!

[acornett21]

Hi @vlella thanks for the issue, just an FYI for Red Hat certification, only the RPM's from the UBI layer are looked at. While you wait for a release of the ansible operator image, you can run dnf update within your own Dockerfile. Alternatively, you can use a downstream image from catalog.redhat.com.

[acornett21]

• Relates: Bump cryptography from 46.0.7 to 48.0.1 in /images/ansible-operator #225
• Relates: Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/ansible-operator #221

[acornett21]

All 17 high-severity CVEs listed in this issue have been addressed on main:

cryptography (GHSA-537c-gmf6-5ccf) — fixed by PR #225 (cryptography 46.0.7 → 48.0.1, now at 49.0.0)

RPM packages from base image — fixed by PR #221 (ubi9/ubi-minimal 9.7 → 9.8):

• CVE-2026-40356 (krb5-libs)
• CVE-2026-45186 (expat)
• CVE-2026-45447 (openssl-libs)
• CVE-2026-4519 (python3.12, python3.12-libs)
• CVE-2026-6100 (python3.12, python3.12-libs)
• CVE-2026-4786 (python3.12, python3.12-libs)
• CVE-2025-59375 (python3.12, python3.12-libs)
• CVE-2026-4878 (libcap)
• CVE-2026-33846 (gnutls)
• CVE-2026-42009 (gnutls)
• CVE-2026-42010 (gnutls)
• CVE-2026-33845 (gnutls)

Additionally, PR #227 removed pip/pipenv from the final image to further reduce CVE surface.

These fixes will be included in the next release.

[acornett21]

Closing — all CVEs addressed on main.