RHSA-2026:11070HighCVSS 9.1

Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update

Published
April 27, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (7)

CVE-2026-33815 →CVE-2026-33816 →CVE-2026-34986 →CVE-2026-35469 →CVE-2026-29063 →CVE-2026-32286 →CVE-2026-33186 →

📋 Description

CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:7a51bab1a606cd7472ae715d80d1cc2a3b9c86869644354d4b4be83f9a320392_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:e4ca37e827701d9602ce7816f39911b0808df9d2673c96731385d76f59808046_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:e8924e76615b9c5d4c04a69ad4f7f2e529383df89e1fe285077b6f4055a1f429_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:f41ad57372406f83d689f7be8edf05088c32c3c98bb349d0da1658433030c465_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:4c594546133a2b8ffb3f142ea1e0d2353e47192f497931b6e81bc6e348f8b221_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:75b567224f0a92727d96d78609e8b896adf742c0bb2c4c29c7d2f6cf4f1c899a_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:8fb531d320ca0499582878bca05bbc0f1ed8a5211d219fc6705e398972010f7f_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:b950a88c68312126e9d448ccc4bca130733d8f8d54cc38ca1a697bb4199d5bbb_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:190480aab6dcffb2c38cb6476f7ee1f153deeb88d9084f6fe40d1e9b23c372f5_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:bf4636b3a9d9b0923f4c593f3fd475d81bee15e768561375b62c198dbe018655_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:dbe8d3be4da19c7da99bc8d207cb9b2abf65287746d53afa5abfad84871dfed1_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:eafe2ea60b4ee8812051759389eece3a2c162b83783daf3806f0945666c9e698_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:c2fb8cbfcb4398c8bcfc6fab634217c3b0f6d33ecb8247b31ab77647f5590a4c_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:1355a9c838c47a45c9960a89c6e3df85be67b57f664174fdb922f25e5a4343e1_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:3bbc3c4278796a92f26478c29c2033c3ba6946db18cb3e193ceafc70e767a260_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:4964c491550d58f9fb7467e659805c9a51b06a20815d25e20b20524b2ac758d1_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:4d728922091dff892202980f8068e66be31dde114535efcab70990e452ff31f4_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:0085ef40238991f5845e814b8af029bae0f86df2b1267db1fc7b183e153261f6_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:134b59523553994370da4c6150b93b468c79b1ee3d7d465537cc377236b8e709_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:5db206a3db9db541be25b7694c68b3e7d8d2bb17ec9f6004c34ecc270aec0635_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:7327f147b034bdc20c2edab166ae3907862a84c5e2ee77fdc1d97a031c0d5956_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7f9e747c719f1afd49cda081cb4c3f3b7781a69a885c588e5ca1975d7fca7a75_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ac3505103967758b81d8aaa7b026aee83a8fee477bf629c280d9e867ea229376_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b5aacc4fb7668db525a499bbe7561910f0c563afb2503280745ec6a344063df3_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:d639affbc1ee9431f734d8ab9bde34bf7cd29be42d6fbb07060ba02849aa8722_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:0a93ca98cec909febd731a080362e5c371b8cdc1aa8772a632a012c2c915166f_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:ab6f139ae0d09334b2b5e499357b0fa14dae54c7a76560d5710ebb3d8fee5bbe_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:d88d142a7f919f6eff8f66c75fdffe3c0efb904273ece05488aad1153c89531f_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:daf11d42d49186f0b1dae8c4be0bb48c7009edbdc25bd84c54bbcad78a9a56ad_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (11)