RHSA-2026:30650HighCVSS 8.7

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.8 security update

Published
June 28, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (15)

CVE-2026-44488 →CVE-2026-44494 →CVE-2026-44496 →CVE-2025-58183 →CVE-2026-34986 →CVE-2026-44486 →CVE-2026-44492 →CVE-2026-44495 →CVE-2026-44487 →CVE-2025-47914 →CVE-2026-39821 →CVE-2026-46595 →CVE-2026-33747 →CVE-2026-33748 →CVE-2026-35206 →

📋 Description

CVE-2025-47914 — golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2026-33747 — BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend CVE-2026-33748 — github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35206 — github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

🎯 Affected products109

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:067f271200af2796324202c723a665d1aee6e012fdc505c94a8b4006112dd2c5_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:34c1cd6fdd14818883b1a0e91d8f5f67de79d7b0d6852b99411ae6c0c961d656_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:665ae8454a39b7afda3026e20040633c8b1024eef66790fcfe2dd21c1a803df9_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:c35772a9737ec2c31498708a8b071e6dfab706ecae2b82d47cba00da335a77f1_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:13c3febd4002fec374561ab0e3b00280c08341d70a239f5af7ade36233b79759_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:45c72c3f54769ecacff8ece969fe435a4777104e9220a3f8dadeae43ee86d097_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:7b6521c16b36c6d5f3d4a2db051a6ff0814541600a4129fe246a408a9f0cc031_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:d6826a9d411de2fcca7a5a22d796b64f99b20e385fce91a92b81f636672c3191_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:14d3124ed9be8e534e8a2377518d7a9bd9bd01e6174dd6781ef1c18ded8815cd_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:2a42eef110a25716570e693a9212a7ce2ce11e46ad8e918e0c7699bcc99a54eb_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:310ba4cd5cabcee512da2cb493232c9364c5ead4f8a9d91b164a56fe3f20fe69_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:99a8b26346d2b30ad0db63f8ff1404d4dbae8bdc634d1fc963bb8b88a8be07b4_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:147834908ded77468a47af91c7b084c9438a5ef5b3dd41f98ea5701a6947b094_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:62de815e7f2ffdc012891bdad911def585432b0ec09f3a1843bede26fabf3bd0_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:807729832d1cc8f5b08cfab70647fef14808d3659377b6b74842a0d093c59eac_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98ff616cb33739725c0f2dbdf4790410f502affbd65a6bc33263b26faa084214_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:2d611b12c195f574342cd4d419fdfc39eeead11c254380799be95b2a8fe7f19e_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:922da17301a8402f164884ae3a64be25bb7c27b720dc3c97d0bebd3b07a7267b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:9f0f83d067ffdc647d55ddf2c5b91ca95e5fb35c8c87e97e3352cdd95ea0025f_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:bc0a00ea7b4e36e64d864bd75267130a2442fe1413574e2fe180b20bf7a73690_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:0d44f8cded5ad717db46e1af2a27e539dfba0c2ae977be51362a7bd35fa709ca_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fa871533e19c9508ad85fbf59925257c9d4fa86be8036a062d1da8a76eb7b4b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:8fbc81afb8dbcd70fc9b68cc71e1502e43ee0e5c9a2d4c8f488366de08dd3699_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:b5f40208ecde27e078eb76b7fcbaec0062998b600647ece378d9fb0d9fe2fb04_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3c25db03df91ebc75331713c22db621e0bd919db08a4ede84fc6b8bc2605b465_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:82715573ed69f32140814702243cf406ede7e789b80a65f8e265299585ef5061_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:c3839de92a3627917604f02a5f755e0187a7e8b13a0659df5ccd5dcef37594a8_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:e3a51132346fe05e29115f2971842f4af557c439ceb243d71b57436ce065dccd_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5887b755757e2ebcbfcb202743e3af5b1618a179c940d589d0079499dd131b5b_arm64 as a component of multicluster engine for Kubernetes 2.8
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Upgrade to a fixed golang.org/x/crypto/ssh release via updated golang or package rebuilds. Ensure SSH servers use supported public-key callback configurations with source-address validation as intended.

🔗 References (18)