RHSA-2026:95730HighCVSS 8.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes - 2.17.4

Published
November 6, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (28)

CVE-2026-56853 →CVE-2026-56862 →CVE-2026-77354 →CVE-2026-77411 →CVE-2026-84375 →CVE-2026-84445 →CVE-2026-14199 →CVE-2026-39834 →CVE-2026-56860 →CVE-2026-71556 →CVE-2026-93748 →CVE-2026-116591 →CVE-2026-56854 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-77405 →CVE-2026-84292 →CVE-2026-106446 →CVE-2026-15815 →CVE-2026-50162 →CVE-2026-50163 →CVE-2026-63209 →CVE-2026-84304 →CVE-2026-84394 →CVE-2026-88031 →CVE-2026-106445 →CVE-2026-33818 →CVE-2026-42127 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-42127 — grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-50162 — oras-go: oras-go: File store write outside working directory via symlink traversal CVE-2026-50163 — oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-71556 — github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding CVE-2026-77405 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77411 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84394 — fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products186

  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:6d6341299c3ddf7155cff774ebae73be48bdb6828077040bd72d6e53480c899c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:7d74feb079dc95e2528001cea65e56fec0f283b2a0917eaeea812fca2583ddad_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:a275e2b74c9d669043ed44ea48835b9e7147b6f3080a4163576271e5e5edb944_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:e8dc86a9e56d2d59ed8ee1ab922fdafd37724e56a198a0fc8a76727ff36b5723_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:1c6ded827c91793138e1be3f60bfecccd5ac34d3d6d5eccd8d7e2d5bf482c5ef_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:6ae4845f1d3b44c44b85f38c4d8e27897a567176314bc43d22071f4b87b82283_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:73c29ce74bd14f5bf0a5ad491a2718fcb9e9fa3c18062f3e2e9ca508d25e7980_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:9a2faf159951347e78b538eaf66561c4ad2576d025fbe93a984b237a15b5f227_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:2ec1ee83a05704cb6cf0aaa185a889862b93e7898fbe99f05667ab0e20ada624_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:72605c1b9f33d6187849c77852c52f0efe914965c6b79d6134c7300fb73a251b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:b0ff88dee7ae7f1a418b1a0c19a10e88040b2e4a6c3a2a29b13f23d3f4cf7f3d_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:b61c1eaefc2ed37fbe829342a808fba5fe44dc5445b2529c26d5a7edf97df017_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:326f4edc2de28267ac9927159578bc84b7ae6c01010075de8ecc8cbf2f39037b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:44a92f3dbb8d065c47af533f80d51ddc68ecb0a84c9c5ee3e8b61429e00e5695_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:4e5a0fa52affbfe7f6171ec5ac13fb6eb518e87e759d71a4c35545978c5cd285_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:c09646dfea721fa60dd748b3b82da7c5a49889f3d66b0c53346e0a133f6db4a2_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:579b7e46dd00991e0b26ccf0523064fb2db96fb226e97cbf229ba346f8d89a89_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:a0f603a257ab7da9a0b6b80729dd7f9f9d197b5cb6488d8e479d326cacb8689a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:a75ed9ce6eabc5117af818dc6965706bfcaafb5600218c48fe0dcc39267d183f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:f4f33611f0238951b269e5744d0618ef0c14f8e6f3b21e851424e4589c1b2c4f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:35cc83db25e9339d57298f42e24cfb6eeb5cc228aeda9f28db8d990c49458fed_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:4c42155ad0da6361600b27f95a215abf1fa74cf176980bfd46bd358056471354_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:6b059fe62fb37e56ecac7b82290b7afa0e942ce1552af98e2f7765c8aaa1ffe4_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:cdb2da4b77baca0a386df7de06b1c36ed58e3642ed1b9e18cfb27f5962d5598a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-operator-bundle@sha256:73c1ea11458f4f95fa4cd3e27e65785774b573bf6a7f526cc892d0c1259cc6d0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:125f9a84d0510771182cce2bbd91f81cfcc21c3b5d44c3010ade13477304aa71_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:d07ec77615005d6c6300029d1a4ecd0bc024bacd5ba0da194894dc2d289a2e9b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:eff50b3864aff1902971d48a2894d9e4983359a78a8232f3d48dd0b763111988_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:fc9fc2d709661cf70cc9f576edc35a6c10bbb196158b6d52fb93a5c73fb5d4ef_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.17
  • +156 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect. Workaround: Upgrade to oras-go v2.6.1 or later. Workaround: To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later). Workaround: Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly. Workaround: Connect applications only to trusted AMQP brokers, restrict network access to approved broker endpoints, use transport security and protected credentials, and update to a Red Hat product version containing the fix for amqp091-go 1.13.0 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (31)