RHSA-2026:95712HighCVSS 8.8

Red Hat Security Advisory: Red Hat multicluster engine for Kubernetes - 2.17.4

Published
November 5, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (21)

CVE-2026-41178 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56865 →CVE-2026-84304 →CVE-2026-106445 →CVE-2026-106446 →CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56862 →CVE-2026-56864 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-39834 →CVE-2026-63209 →CVE-2026-84445 →CVE-2026-88031 →CVE-2026-39822 →CVE-2026-56860 →CVE-2026-93748 →CVE-2026-39821 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-56864 — golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB CVE-2026-56865 — golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

🎯 Affected products162

  • multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:514238b3d00d832c7b154d88700df02b3b69da1186c9565d3f294a3b1122136a_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:58e46ecf7c755af6646848c25d38f30812e639c7bd3b6e1d4dace9454c73bf4b_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5c8d99ed82e6c1f8c0001f742980ce0423980ff98f7fa84d0dbf49377cf5d4fb_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8dc749aa71da35422f18240fdada9b2c3e05c87e697e41e7c4a7722d0a34f6bd_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:01fe0447b3b56ae64b7284d6b345576fd4c01dd948c552a9ad89afd1ca441fb0_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:0dcfb21f0d96aab1ca6c5f2c69b775c3696c458823ccd7b0b363a42939a4380d_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:46fecb05769b114cd199ba06ad399f3c09d203d597c123bfe9706b888bebff34_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:b58da4b6f466d96291a8fc8f3499fe0853649a0b5e8f3f94015190b755c83e8a_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93dd3ff78f06d137c23b30a38dc7ad71516f4911eab98713a00b758451744db2_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:cee08a8787552740b55e17589b0d22f757a9745d6bdaae0b90e0ffeeabc84f84_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:d30b0971366808e715dfc07d44cc0289a374acb1a96cd579a15ea416eaa9514b_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:f517fd2cdd4a44dba5a840e119a69478f950adc7aca711570e18d7ecda0cd7c8_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3b7018314d427e2c7bce6d80d828d6847988afaec7043bd92c17a3e0747e65b7_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:970123e63640892c24939e0be2a40076c4ef6f29dea0c3b917cfd416d9a35c73_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:ce45769ab7bfc6916ef671a22559da13bf17b181b08d95dc79d9297dc060cd07_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:f0e185714155dc85dd05c783e8f2ad743351d4686a1391b84abcd4d57efe2bfb_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:36a4e79c836d1edd3f2d0822e7c895bddd11aa9bf2246bcef0286634aeee5613_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:4582a10d6e7a683d0d1cdfbdb113d2237df12af06cf6c87662a4a53f17a15975_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:4f8cd8c5d6103f13a570716e11ee86e2c5a8d2b739d8b82961ead6abd40f3176_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a239273d00237aa697c3cedd94155fed643bd3554fc7e46499bf15b4511cdea8_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:060b762489e5ada63f6d53b2838a1f5b7b186f61acb47cc6998f1ab02034151a_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:0c7263b098ebe082fbf45e699aca0588a50d4985742554f4dbe40e74b04216b1_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:140a5fd9ce7349350c286d7e6d3268637089c373e8a49e86ea2245f17fb23ba3_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:3527c9d95dafe2e1a791d1084a89946dd127ddbb9bdf2a9f8f8c78c90be993ed_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:1514ae4f7061bf84df707afe8e250c0cfc3bede3fda73e759976372b962b524f_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:3e0b680cc36aa8e15c68e33a10bfc26c31d424f0655bf8ff3f0be46503cb363c_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:48c0ebefd09b5c21734b504fadc3c92889d70782c443fe1f0717b30d77f9255b_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:8f3b3e12e3613811fc46b5a305f204d2f84bd9ec43d2014bc9ac32c6d544a09c_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:03196712d54ac5905f2ff2a121179fda6208d688e61cad314bfdb8bd85c73394_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • +132 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/latest/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: No mitigation is available for this vulnerability. Update the affected packages to golang.org/x/mod version 0.40.0 or later, or Go toolchain version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.

🔗 References (24)