STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must continuously scan components, containers, and images for vulnerabilities.

DISA Rule

SV-257586r961863_rule

Vulnerability Number

V-257586

Group Title

SRG-APP-000516-CTR-001335

Rule Version

CNTR-OS-001060

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Vulnerability scanning can be performed by the Container Security Operator, Red Hat Advanced Cluster Security (formerly StackRox) or by external applications. Follow instructions from the application vendor if using external tool for vulnerability scanning. To install the Container Security Operator into the cluster, run the following:

oc apply -f - << 'EOF'
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
labels:
operators.coreos.com/container-security-operator.openshift-operators: ''
name: container-security-operator
namespace: openshift-operators
spec:
channel: stable-3.8
installPlanApproval: Automatic
name: container-security-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
EOF

Check Contents

To check if the Container Security Operator is running, execute the following:

oc get deploy -n openshift-operators container-security-operator -ojsonpath='{.status.readyReplicas}'

If this command returns an error or the number 0, and a separate tool is not being used to perform continuous vulnerability scans of components, containers, and container images, this is a finding.

Vulnerability Number

V-257586

Documentable

False

Rule Version

CNTR-OS-001060

Severity Override Guidance

To check if the Container Security Operator is running, execute the following:

oc get deploy -n openshift-operators container-security-operator -ojsonpath='{.status.readyReplicas}'

If this command returns an error or the number 0, and a separate tool is not being used to perform continuous vulnerability scans of components, containers, and container images, this is a finding.

Check Content Reference

M

Target Key

5547