RHSA-2026:12337HighCVSS 9.1

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.11.1

Published
April 30, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (2)

CVE-2026-7163 →CVE-2026-33186 →

📋 Description

CVE-2026-7163 — assisted-service: assisted-service: Authenticated users can gain administrative access to OpenShift clusters via credential disclosure CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products21

  • multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8280d5b264d82f646a074ba80a28e518c65eda85210dd73dcce1305baf3db753_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:a2c980a42ab1e99d5c6074552782255ebc5b6275237f4d2cb1bfe5d4f1acb490_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:b2fc9804cf2aa1878c1fb851078a674463764be90c36ddbaa97f77789370efe3_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:f25ec53e76b16f620e5e067ccd57005267691bb910989a704e6cd86329372c9a_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:49c62e8ac4762849f1596729a752cd88a0d6aefb40a7a459e9b22493c1e275fd_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:6cc1e0e0351c80d62ff578df84de51759c5d611d4650f9047fe9053e6afa6faf_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:8a251e3cb7bca9d6c3ed20829849bfc6361c8c168feef6dab7c1e06ada9ecce0_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:9f5ee10acc225f6e4aba6fdbfcfe01851cf1483181be2ade6f0b002990316079_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:520b5b7722318d06646aa55a3fe98359aab8d3fa011bf8ca1e52e111a43afe1a_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:715a03b50ac63a96f6256bb7f0685e8fd22d59ded6746c9bd8ff464970cce19a_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:a73d454ca721268d3ba17a6b3c9a76f8f80c2acbf28e6f94c507e388301bf531_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e364c549150a4ee3ba20d9fa199d0dca2173cbb6486f232e59e9bf1ced7054b7_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3b00ae767102c4073f4a55f4962cbd4cfcc8ac6b52620da7fa3010c5b8d39799_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:93d8e7a6bfefcb523c18dad0c84e99e38574b0025720161bdbd088033c4c8c4f_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:c5761317d9acf329047e751d6d2573c4edfe136e06d752d2f6aeef2006b71392_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:e11544a9a4c4d501a4b863d58230d7e4649c90e23b3557ae4a09aed9ec7dc6cb_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:1133ab36a25af5c4c813b104d26502705be4932c334641243a6fb390637a6e17_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:233424d7f85dbc64152a7c08c48db76cff54a4845e088384d6f1d48194fae646_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:3c5128eee15019b8775c87a78caf1e4a40e9fe3b52daa9622b0238a3607fd251_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:d90e9b64aca66528a4d359b506b2d338fba7ac9072ce4292c6498848ee20bf7a_arm64 as a component of multicluster engine for Kubernetes 2.11

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.16. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (5)