RHSA-2026:22689HighCVSS 9.1

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.7 security update

Published
June 2, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (2)

CVE-2025-30153 →CVE-2026-33186 →

📋 Description

CVE-2025-30153 — github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products109

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5001f350e9319cedda664adff989968f77c20825709342db8d04c2d530b088e8_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:54cacd7dc26de4bdf49ccc187c756a20c7b58497bdca3d5d4df9fabeff4e2d6d_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:c9d0fbad204db6c28723c0811e29c782fcf78177aa0c4cb76cf7e459d461e82b_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e103a3784d1535e375d97589702d3998981e6f4bcf7b7a3b51a9c20435719bb1_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:4e7dd7f6d30cec72e2e8a3862e64f4e6ced0e68afe3750fe68ce17cf8d13b93c_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6a160f374da4e857295b19e865a55fd337e584fbcf241205327d91834701d3f6_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6f8ad1c7816c085afe63afc086f23e7651865c8397aea1c9ff59d0b3990b8646_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:840c49f2cb28bf637428aa73a2d2d7d802e6a2363552457a9cbfc8ea4a25afcf_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:44ad772241a2bdf7b22e391abe0ac82beeb5f69d4f2d3230607009e0b1a35cef_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:546560f894ca950b74e8293f2e025b428ff906cf03ad2fd4fb5f37e27ee69174_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:9c6dd63a78d855f887aea95b27c20779247099c71753688c9923726a762a88a9_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:edb0a420440a04f83e8834e9d84dca877ac5114dd764aeeab5d29d7134baf5c5_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:14d4ec36b05faf321368d73e292e843fabe093141c6102a3a4ebffefc4457907_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:1c3a6b175b9970d3efc0e82747bc6cb40409c11b205cfdf5e7da5e21f453de18_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:658f8119b4fa0d05372c412aa2eb666fcc1af93bd1b43129c8bd974a32c6994c_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6cda86b03482720fb426c2094e3f0175992657019ad4f018ea18f019c7f6159f_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3bdb08c6e0b2ebb599b5a93fc731ff206f10a3ba663aafe8377a3ae50190cfaa_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:66d0d8a550f5f90d29516e40ca81b309a44723ba18195d5a3d5e56e2495b7069_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:6c2148a6a037f97f1cb2bb57b0d7e791dd027e04a55c8519015ae066a27c2cf4_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:f6f1088553452a06f4632b7f6485dbe8bfa5e396881e018662f61be7ff5fbf1b_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:2ecab1cef8696f2c0e400e25b9d45d32cd198a3e168b4534fcbb3c46b0327363_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:68e56d8b9e2715117e3dd89abfc9d7220a45fda0965086abcda4c1ad2b00fa36_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:9e2d59a0a587d6d23972a6e9fd16469aaa2448989cc86033e84d88e37f2cbc90_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:dd3e4d5d3e9c255dc2b9bf3dc6675f5d6ee78c5afcc9b214da91be78842478b2_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:42602795e2249ad279ec0d93ae80cb03f40a21969c3e1ca6350efc77b1da32ce_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:4fbaffb883d450382ad2c202b2372ee769fd1aae74289f4b301d05248f88f598_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:cef07c3fc4831e05dc541ceaaffac3f83c9aa4cae2c17704b0fd1b138def6a85_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:fa8de138c63a8cda91479c1373de7d8bf57c079c0d497247ce3d614ff74447b2_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:7b80adbd681f47b15cda7c93983744e6f82565f5e9fcc1b61419898cbce42d32_amd64 as a component of multicluster engine for Kubernetes 2.8
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Disable any endpoints in your OpenAPI schema that allows multipart/form-data or allows the uploading of a zipfile. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (5)