live wire
▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel▸AI · EAGLE-4 0.1.4 fixes multi-GPU vLLM collective ordering during startupEAGLE-4▸SECURITY: Apache Camel 4.23.0, 4.22.2 and 4.18.5 fix eight component vulnerabilitiesApache Camel▸AI · Red Hat shows DRA doubles llm-d KV-cache throughput by aligning GPUs and RDMA NICsRed Hat Developer▸Red Hat Developer Hub 1.9.10 ships as a Critical security updateRed Hat errata▸OpenShift Dev Spaces 3.31 adds live editor switching and DevWorkspace Operator 1.0Red Hat documentation▸OpenShift Pipelines 1.24.1 tightens Manual Approval Gate RBAC and approval integrityRed Hat release notes▸AI · Red Hat survey: 97% of UK CIOs trust agent security, but 43% can trace data flowsRed Hat▸JAVA · IBM and Kaggle launch a living benchmark for agentic Java framework migrationsIBM Research▸AI · Red Hat tests policy-derived data controls for AI agentsRed Hat▸Apache Camel pattern turns routes into bounded LLM tools and MCP servicesRed Hat Developer▸Atos tunes small models on OpenShift AI for structured German-language analysisRed Hat Developer▸Red Hat publishes checklist for evaluating third-party OpenShift applicationsRed Hat Developer▸SECURITY · OpenShift 4.21.40 patches OpenSSL, OpenSSH and PCRE2 flawsRed Hat Product Security▸SECURITY · Apache Camel fixes A2A webhook SSRF gap in 4.22.2 and 4.23.0 (Oct. 23)Apache Camel
upstreambeat.ai
releaseSUPPLY CHAIN

OpenShift Pipelines 1.24.1 closes Manual Approval Gate privilege gaps

The update removes broad authenticated-user access and makes approval requirements and approver records immutable after task creation.

By The News Desk· Oct 27, 2026the quick take — two AI hosts go live when you do

Red Hat has released OpenShift Pipelines 1.24.1 with a breaking access-control change and two integrity fixes for the Manual Approval Gate component. Platform teams using approval tasks should review their namespace RoleBindings before upgrading.

Broad authenticated access is removed

The release removes the system:authenticated group from the Manual Approval Gate controller RoleBinding. Red Hat says the previous binding allowed any authenticated user or service account in a cluster to approve, reject, list or describe approval tasks across namespaces without a more specific RBAC grant.

After the update, users and service accounts need explicit role bindings to manage approval tasks. Red Hat directs administrators to bind the shipped manual-approval-gate-approver ClusterRole in each relevant namespace. That role is intended to supply the minimum permissions needed for approval-task access.

This is the operationally significant part of the update: existing approval workflows that relied on the broad default binding can stop working until administrators add the narrower namespace bindings. Teams should identify the people and automation accounts that act on approval tasks and create those bindings before rolling out 1.24.1.

Approval policy fields become immutable

The update also hardens the webhook that validates approval-task changes. The webhook now prevents changes to spec.numberOfApprovalsRequired and spec.description after a task has been created. Previously, an approver could change those fields while submitting an approval, including lowering a multi-approver requirement.

A second fix adds validation for changes to spec.approvers. Red Hat says an approver previously could add entries already marked as approved during an update. The webhook now rejects attempts to add, remove or modify approver entries on existing approval tasks.

Together, the fixes move the gate closer to the behavior its name implies: authorization must be granted deliberately, and the approval policy cannot be rewritten as part of the approval action.

Availability

OpenShift Pipelines 1.24.1 is generally available for OpenShift Container Platform 4.14 and later supported versions. Because the RBAC correction is explicitly listed as a breaking change, upgrade preparation should include an inventory of Manual Approval Gate use, existing RoleBindings and the service accounts that submit approval decisions.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk