Skip to contentRed Hat Multicluster Engine For Kubernetes 2.11 vulnerabilities
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkCVE-2026-732677.7 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreMce-operator-bundle: all github actions pinned by mutable tag, not commit shaCVE-2026-755697.7 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeCVE-2026-667949.3 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreManagedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)CVE-2026-667959.9 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreClusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset joinCVE-2026-732667.1 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreProvider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorizationCVE-2026-191305.8 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionCVE-2026-732689.9 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local saCVE-2026-732699.9 Critical
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.6 +2 more +4 moreCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenCVE-2026-100599.1 Critical
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterCVE-2026-171078.5 High
- red hat logging subsystem for red hat openshift, multicluster engine for kubernetes, multicluster engine for kubernetes 2.1 +17 more +19 moreHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesCVE-2026-162429.4 Critical
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +49 more +51 morefast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-13676Fix available7.5 High
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 moreInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsCVE-2026-42508Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 moreInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/sshCVE-2026-39835Fix available5.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 moreInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentCVE-2026-39832Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 moreInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshCVE-2026-39830Fix available9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 moreInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/sshCVE-2026-39829Fix available7.5 High
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 moreInvoking bypass of certificate restrictions in golang.org/x/crypto/sshCVE-2026-39828Fix available6.3 Medium
- apostrophecms sanitize-html, red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +27 more +29 moreApostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`CVE-2026-44990Fix available9.3 Critical
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- red hat multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.7 +2 more +4 moreAssisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosureCVE-2026-71636.1 Medium
- axios, red hat cryostat 4, gatekeeper 3 +61 more +63 moreAxios: unbounded recursion in toFormData causes DoS via deeply nested request dataCVE-2026-42039Fix available6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge StrategyCVE-2026-42041Fix available4.8 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0CVE-2026-42043Fix available7.2 High
- axios, red hat cryostat 4, gatekeeper 3 +59 more +61 moreAxios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42044Fix available6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +57 more +59 moreAxios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request HijackingCVE-2026-42033Fix available7.4 High
- moby spdystream, red hat cert-manager operator for red hat openshift, cluster observability operator 1.5.0 +44 more +46 moreSpdyStream: DOS on CRICVE-2026-35469Fix available8.7 High
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 morefollow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect TargetsCVE-2026-40895Fix available6.9 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 moreOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)CVE-2026-29181Fix available7.5 High
- red hat multicluster engine for kubernetes, multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +4 more +6 moreRhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validationCVE-2026-4740Fix available8.2 High
- go-jose, red hat assisted installer for red hat openshift container platform 2, cert-manager operator for red hat openshift +110 more +112 moreGo JOSE affect by a panic in JWE decryptionCVE-2026-34986Fix available7.5 High
- grpc, grpc grpc-go, red hat assisted installer for red hat openshift container platform 2 +166 more +168 moregRPC-Go has an authorization bypass via missing leading slash in :pathCVE-2026-33186Public exploitFix available9.1 Critical
- immutable-js immutable, immutable-js, red hat cluster observability operator 1.5.0 +90 more +92 moreImmutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutableCVE-2026-29063Fix available8.7 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-6322Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical