RHSA-2026:11217HighCVSS 9.1

Red Hat Security Advisory: RHACS 4.8.11 security and bug fix update

Published
April 27, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (8)

CVE-2026-33816 →CVE-2026-34986 →CVE-2026-35469 →CVE-2026-25679 →CVE-2026-29063 →CVE-2026-32286 →CVE-2026-33186 →CVE-2026-33815 →

📋 Description

CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products46

  • Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:5fab4694b598d616ca775835520c8d062940bec75a5bd820b2290134529b280b_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:677f693e3db20c1f56c9d51905fc45b7ea1efce12e3fc6cf90486f2c9f1d21b4_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:aa5d6eb26500ce81f59a43047d24e9a7eaea4e1d3ab4d428e05fb1298aef1b97_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:edc41b3c96f9dd9bd96851d4d6cce65a23da484af08b48caba90570960a2e53a_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:4c594546133a2b8ffb3f142ea1e0d2353e47192f497931b6e81bc6e348f8b221_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:75b567224f0a92727d96d78609e8b896adf742c0bb2c4c29c7d2f6cf4f1c899a_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:8fb531d320ca0499582878bca05bbc0f1ed8a5211d219fc6705e398972010f7f_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:b950a88c68312126e9d448ccc4bca130733d8f8d54cc38ca1a697bb4199d5bbb_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:5804b537b255c13107f7ab6d48b445c4210f4274e19a011d37b3302b35a965e5_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:73f57091087f8e418c77f29624916bbf9f668c6ff172e4da93d3b1fea3234642_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:a8008b13ae24b0ccc4ab75e1642e2eb995e7d5e62e18acc5383b413fc6c06cb3_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:b4a010d33119f95358539599665929e003dc366c73bbdbcf06d37f4e086c77c1_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:0b617b6f12fe77636cbd3036d07b299165acb932edd407cc066987026c51bc2f_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:24732ee9e493c03e816d0ccc4874f9f27211a7de11fc8f345f0976c9e72d8210_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:91f791cb74011fb5e0832dfb50864d33439ab94deed91fe248430e63350617a6_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:9ef18af4c57b3f67065233e46129887d9b703fe65f39cecc83f41e3ba18542ce_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:bdb808907802ae12515143661358af8e374bb635f48bc89d983b3f2cf5360d21_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:3290bf6033dffb72084afd9eb038f0268b76ea1112121e587da172d7cd432e68_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:958128da0821405d5dccc557c61336b9d19eb752eb54e667dbca3bc1ea97ec85_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:c5c8f2959b593149bfc654e5c212144c1640441d6512d91b0c0ed6a7b9474cbe_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:d769ee8de44cc320ffcc68e76f43d63a381207362a9ef1e182912aaffa1a4dca_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:7f9e747c719f1afd49cda081cb4c3f3b7781a69a885c588e5ca1975d7fca7a75_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:ac3505103967758b81d8aaa7b026aee83a8fee477bf629c280d9e867ea229376_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:b5aacc4fb7668db525a499bbe7561910f0c563afb2503280745ec6a344063df3_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:d639affbc1ee9431f734d8ab9bde34bf7cd29be42d6fbb07060ba02849aa8722_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:0a93ca98cec909febd731a080362e5c371b8cdc1aa8772a632a012c2c915166f_ppc64le as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:ab6f139ae0d09334b2b5e499357b0fa14dae54c7a76560d5710ebb3d8fee5bbe_amd64 as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:d88d142a7f919f6eff8f66c75fdffe3c0efb904273ece05488aad1153c89531f_s390x as a component of Red Hat Advanced Cluster Security 4.8
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:daf11d42d49186f0b1dae8c4be0bb48c7009edbdc25bd84c54bbcad78a9a56ad_arm64 as a component of Red Hat Advanced Cluster Security 4.8
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (12)