Key takeaways
- Red Hat Advanced Cluster Security for Kubernetes 5 (RHACS 5) adds vulnerability management for Red Hat Enterprise Linux (RHEL) virtual machines hosted on OpenShift Virtualization.
- The update integrates the CISA Known Exploited Vulnerabilities (KEV) catalog and CVE origin indicators to distinguish Red Hat from OSV.dev severity evaluations.
- Init container vulnerability scanning and policy enforcement reach General Availability, operating during build and deploy phases by default.
- Red Hat has completed its migration to ClairCore-based Scanner V4, formally removing the legacy StackRox scanner engine and offering Extended Lifecycle Support (ELS) up to three years.
- Technology previews introduce OpenShift Lightspeed deployment risk explanations and a read-only Model Context Protocol (MCP) server for querying security posture data.
Red Hat has released Red Hat Advanced Cluster Security for Kubernetes 5 (RHACS 5), introducing native vulnerability management for Red Hat Enterprise Linux (RHEL) virtual machines alongside containerized workloads. The release allows enterprise security teams operating on Red Hat OpenShift Virtualization to scan guest operating systems, prioritize software flaws using enriched CVE origin indicators and federal exploit catalogs, and enforce security policies across hybrid infrastructure from a unified console. In addition to general availability for init container image scanning, RHACS 5 completes the migration to the ClairCore-based Scanner V4 engine and introduces technology previews for AI-assisted risk explanation and Model Context Protocol (MCP) data access.
Unified VM and container vulnerability scanning
As enterprises consolidate legacy infrastructure onto Kubernetes, many organizations run traditional virtual machines alongside cloud-native containers. Until now, managing operating system vulnerabilities in those virtualized environments often required separate host-based agents and disjointed reporting consoles. RHACS 5 bridges this operational divide by allowing security teams to inspect supported RHEL virtual machines running within OpenShift Virtualization.
The new capability scans guest operating system packages directly, evaluating them against known vulnerability databases without requiring dedicated third-party scanning infrastructure. For security leaders, having visibility into both container images and VM guest operating systems within the same control plane simplifies governance. Teams can evaluate vulnerability findings on virtual machines situated next to microservices, ensuring that legacy application components do not create unmonitored attack paths into the broader cluster environment.
| Security Domain | Previous Architecture (RHACS 4.x) | Advanced Cluster Security 5 |
|---|---|---|
| Workload Coverage | Container images and Kubernetes host nodes | Containers plus RHEL virtual machines on OpenShift Virtualization |
| Default Scanning Engine | Legacy StackRox Scanner with optional Scanner V4 | Scanner V4 exclusively (legacy StackRox engine removed) |
| CVE Vulnerability Context | CVSS scores from primary feeds | Origin attribution (Red Hat vs. OSV.dev) and CISA KEV catalog flags |
| Init Container Policy | Limited scanning options | General availability; build and deploy policy evaluation active by default |
| Compliance Management | Standard Kubernetes compliance checks | Automated schedule management for OpenShift Virtualization compliance profiles |
| AI Investigation Tooling | No integrated AI assistant connectors | Technology preview of OpenShift Lightspeed and read-only MCP server |
| Support Lifecycle | 12 months support with 12 months maintenance | Standard lifecycle plus optional Extended Lifecycle Support (ELS) up to 3 years |
Enriched CVE context and compliance automation
Managing security across thousands of enterprise workloads generates a high volume of vulnerability reports, creating triage bottlenecks for platform teams. RHACS 5 introduces vulnerability context tools designed to help administrators prioritize actionable remediation rather than chasing raw Common Vulnerability Scoring System (CVSS) totals.
A central update is the CVE origin indicator, which differentiates security assessments provided by Red Hat from those sourced through OSV.dev. Because vendor-specific security teams frequently adjust severity scores based on package compilation flags, backported fixes, and platform configurations, displaying the origin prevents confusion during audit reviews. Security teams can filter findings based on origin across the RHACS web console, APIs, and exported reports.
Additionally, RHACS 5 integrates data from the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. When platform operators assess backlogs of critical or high-severity vulnerabilities, the catalog indicator highlights flaws with documented active exploitation in the wild. Teams can schedule recurring reports or export targeted CSV summaries directly to remediation owners, focusing developer and system administrator attention on active threats.
Compliance workflows also receive targeted improvements. Security operators can now schedule automated compliance checks for OpenShift Virtualization profiles directly through the RHACS interface. Combined with the general availability of init container image scanning—which now enforces security policies during build and deploy phases by default—administrators can prevent non-compliant workloads from initializing without custom policy overrides.
Platform support, Scanner V4 transition, and AI tooling
Beyond vulnerability triage, RHACS 5 incorporates major architectural changes and updates its enterprise support framework. For existing deployments, this release completes the transition to Scanner V4, an indexing and matching architecture built on ClairCore. The legacy StackRox Scanner engine has been removed entirely, requiring administrators upgrading from older versions to verify resource configurations and database dependencies before applying the update.
To align with enterprise infrastructure planning, Red Hat has harmonized RHACS lifecycle policies with the OpenShift platform. Each point release continues to receive 12 months of full support followed by 12 months of maintenance. However, qualifying versions now offer optional Extended Lifecycle Support (ELS), providing up to three years of coverage with annual ELS releases. This extended cadence addresses long-term stability requirements for regulated industries that cannot accommodate rapid platform upgrade cycles, complementing broader platform initiatives documented in Red Hat’s OpenShift 5 platform lifecycle.
The release also introduces two technology preview features designed to support security investigators using generative models. The first connects with Red Hat OpenShift Lightspeed to generate plain-language explanations of deployment risk scores, detailing the factors contributing to a workload’s calculated exposure. The second provides a Model Context Protocol (MCP) server, allowing authorized external AI assistants to query cluster vulnerability posture using read-only API tokens. Red Hat emphasizes that both AI capabilities function strictly as analytical aids, leaving final remediation decisions with human security personnel.
What happens next
Organizations evaluating RHACS 5 should review their current deployment architectures before initiating upgrades. Because the legacy StackRox Scanner has been deprecated and removed, clusters running previous releases must validate Scanner V4 readiness, including database sizing and network access to vulnerability repositories. Furthermore, because init container policies are now enforced by default during deployment phases, platform engineers should audit existing CI/CD gates to ensure legitimate startup routines are not inadvertently blocked.
Platform teams operating mixed environments on OpenShift Virtualization can begin testing RHEL guest VM vulnerability scans to establish unified patching workflows alongside existing container pipelines. Red Hat offers trial subscriptions for organizations looking to assess the operational impact of unified scanning, while enterprise administrators can consult the official RHACS 5 release notes and migration guides to plan their rollout schedules.
