RHSA-2026:22423HighCVSS 9.1

Red Hat Security Advisory: Multicluster Global Hub 1.3.4 security update

Published
June 2, 2026
Last Modified
September 19, 2026

🔗 CVE IDs covered (20)

CVE-2026-25679 →CVE-2026-27137 →CVE-2026-32282 →CVE-2026-33487 →CVE-2026-32285 →CVE-2026-33186 →CVE-2026-34986 →CVE-2026-41606 →CVE-2026-41636 →CVE-2026-43869 →CVE-2026-21728 →CVE-2026-32283 →CVE-2026-32286 →CVE-2026-33815 →CVE-2026-41605 →CVE-2026-33816 →CVE-2026-41602 →CVE-2026-41603 →CVE-2026-41604 →CVE-2026-41607 →

📋 Description

CVE-2026-21728 — grafana/tempo: Tempo: Denial of Service via large queries CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-32285 — github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33487 — github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-41602 — github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation CVE-2026-41603 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation CVE-2026-41604 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41605 — Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability CVE-2026-41606 — Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion CVE-2026-41607 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41636 — apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion CVE-2026-43869 — Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation

🎯 Affected products22

  • Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le as a component of Multicluster Global Hub 1.3.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 as a component of Multicluster Global Hub 1.3.4

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (23)