RHSA-2026:0627HighCVSS 7.7

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.5 security update

Published
January 14, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (7)

CVE-2025-58183 →CVE-2025-58754 →CVE-2025-7195 →CVE-2025-9287 →CVE-2025-9288 →CVE-2025-27144 →CVE-2025-47907 →

📋 Description

CVE-2025-7195 — operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd CVE-2025-9287 — cipher-base: Cipher-base hash manipulation CVE-2025-9288 — sha.js: Missing type checks leading to hash rewind and passing on crafted data CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check

🎯 Affected products177

  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:665b6a98c4bbf958afddaea131ae92b461b9a2a169d310c3880d6d15e64efad5_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:94ad71c13775aca9811cd0b0068c57c44e0fbcd161d82b9e44baa03c6c989feb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:a1b37231e73ef52d13f8c6a84f943f1e5f51121e0ceb78b9405d9081aa292fb1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:cfc3e2ec8aef53bef990b871e97fcffc2e1001d5b6a42ae4e34181cb3877ddf5_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:2e4e2180d5912535ac4914569e5e592a501260199cf5371b7d0ac9aec290d0e8_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:6cc312032def2c245b43e6af8d57b319616a2713a6bd4f865ee99be6309e5846_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:784b6f4a2ea7f405f769903ee8c12998cf7b27112f9fee75039a6c0f4154a998_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:e1560f85d5351cdf0f0fb90e7d13506a7bb5a0da0a0f414db7b82ca87192912b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:37be373535e469c34571baeb73cd898341596abd32ada59eb7f70d58e415df39_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:8be6a862ffa9225b1a84dcd84ed9988fdda18ef2d65839426d9a9b3177685915_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:a93229f32b4fb37b113c9e4faed2eab0e4964df4018f098c8a5c98afd4504e77_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:f6f8d26d898df4a477072149e59ffc19429ebab876c8cd2a0d6a651a9c3b6f3f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:08b1b9b15029874e227df06846d49560c9594c7885edc57d58cc75c696b068ee_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:3ca63d4a623ac3e7e0ed562e467ed6cafe3f321212b63f2f8591a026fd0f6bf1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:73ac6ebec978921805d11d61c5806c2efb77e1aa5d029aee8fd24bf88542b156_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:c5554d7510c3031b77bb79106dbdafbaf799c4162939f3ec54bdd5695d106d09_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:23ee5821994d30b1baeea676d33779059e69ea27b25a776aebc91cc05e7088ea_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:53da7d735dedf07c2379c7f5e208d72537493df6792ed60b90237a428ce71bdb_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:60c34f4c57bf1868afdae915f69927132af9f5aa03cd700a0dc1cbaa1005aecc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:995699e6ce30f497b4941121469449d7b89233cf02f1972bc9baa76de38cd252_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:6e7c13d8d8c5e77a321a23649851b6e51471470d3f5a382e37351112ad8a91b2_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ca9df94a780782b0ff4d63ddd56d5e0cb63faa2277a10ce162a570ed8e7af6eb_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ea5ed610e44cb35d57088dd96403adb224ddb0e1f526750032749a1c8fe6f1ab_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:fb369b72bf0a5b34fee9c180c2e4a43aca6e537edf79140b1ce1c9c80f5d068b_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:76d8f8546ff38e0d110d56dffa0a1e62cc9690f5696454586fe3e179db1dd8c3_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:d557d9639e5b26b69181b907e760a826c1e6afeeec4f8f94bf69143a3f3a2115_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:de02b80919c8cbaa9cffe71f72c146f5e443c2d568bbd2555726da90fbcd9a70_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:f7c99508aabf170fbd414bd70b013501ea22e43aa5a80626e86c6f9386c89fe6_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:5ddea05da3eb7b6baca832ae672b7d85d7367392d2a9ce21416c604ce901e907_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • +147 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: In Red Hat OpenShift Container Platform, the following default configurations reduce the impact of this vulnerability. Security Context Constraints (SCCs): The default SCC, Restricted-v2, applies several crucial security settings to containers. Capabilities: drop: ALL removes all Linux capabilities, including SETUID and SETGID. This prevents a process from changing its user or group ID, a common step in privilege escalation attacks. The SETUID and SETGID capabilities can also be dropped explicitly if other capabilities are still required. allowPrivilegeEscalation: false ensures that a process cannot gain more privileges than its parent process. This blocks attempts by a compromised container process to grant itself additional capabilities. SELinux Mandatory Access Control (MAC): Pods are required to run with a pre-allocated Multi-Category Security (MCS) label. This SELinux feature provides a strong layer of isolation between containers and from the host system. A properly configured SELinux policy can prevent a container escape, even if an attacker gains elevated permissions within the container itself. Filesystem Hardening: While not a default setting, a common security practice is to set readOnlyRootFilesystem: true in a container's security context. In this specific scenario, this configuration would prevent an attacker from modifying critical files like /etc/passwd, even if they managed to gain file-level write permissions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters.

🔗 References (11)