RHSA-2026:12116HighCVSS 9.1

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.2

Published
April 30, 2026
Last Modified
July 28, 2026

🔗 CVE IDs covered (3)

CVE-2026-33186 →CVE-2026-34986 →CVE-2026-7163 →

📋 Description

CVE-2026-7163 — assisted-service: assisted-service: Authenticated users can gain administrative access to OpenShift clusters via credential disclosure CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products21

  • multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3f59623b74897f179a86165b21baad080d562b3acaeb44316273078002b02219_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:448b0ebba6b79d15613a0e77929c44006bced1bab7c1394e8ee50783275f082c_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:786b3e50adeca379bf6e1a8ceeddc8bef235dfdbacc1caa77d0c1903c1069569_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:f11864d3c913d54cbbfdffdf2dd138c8fb43998128d1319cf29c4c731f2f2c73_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:2015da323dfa9350f4192cce4d835c6a156041ebb8f13e3974e86cd8a0ac1114_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:57d6348d03788f7776f78f1ef75cf2cca02a3cfc9a562dd2d34ec00c30c3b25d_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b6327e916068ceddbce6e1e64d89d0fe6501eaf7db702fd883ddd67412e35dc6_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:bfe5610b8d03fc7a9130d5e7b6dc7a9ac63903e2a21103ecc4d0ff1419eedc74_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:085d4698e4eb08202f1f9f1e6a85a3b0251a5d185ca9c9f4b77612640dd4fb54_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:12c01eb1e7b49ed43c86679afeecfef474dcb2dda051da83df825150fe910b6f_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:52b698386cf12b8423f3af3e27f25455e5bf248b8ed3b2713eca37ed64a78c2a_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:f0ba1bf837f9f7f8db43b9597c49348b17f33d784129571f9f9646d5f6f4ac5c_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6d7a77accd0f6c9eb52245c5f5b461be4522e251f35e90aec52b0f29ea81873a_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:7a73a376c4cca97ac7e80feade1fc2e652a31982967da489000c86fe810ab823_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a12f7d2451e297af33630d51d94b2ecba37747e50a33f7cbb7f5c267e63e7258_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:e1e9c33da21dc580cb93da748a4a22547a05b11fa33a97a744baebf26f351153_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:07ff3070b9860ada744508a2a1710014c23f7f44a1ac8547c8885368d79baee3_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:3774f8be3f1a4ca6a46aa3aba3ed6135dcd90ef0985f9b16e46b8b00e92f8e17_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:73f20e3ce70608c606eeddc39e8dbd08747d0d27b4d6d84aaeddff8b32aaa3a8_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fe73f932f408abfa6bed69664b73af371bb2a58e94a5da43491a65eeee774252_s390x as a component of multicluster engine for Kubernetes 2.10

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.15. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (6)