RHSA-2026:13791HighCVSS 9.1

Red Hat Security Advisory: RHACS 4.9.6 security and bug fix update

Published
May 5, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (10)

CVE-2026-29063 →CVE-2026-32280 →CVE-2026-32281 →CVE-2026-33186 →CVE-2026-34986 →CVE-2026-35469 →CVE-2026-25679 →CVE-2026-32282 →CVE-2026-33815 →CVE-2026-33816 →

📋 Description

CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products46

  • Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:053ed22d937f9eb84e634c015d41bb2078a7045caaecca91ff92d6cc762a2f31_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:39d0e4f3d7161d55db772e78503e8f17384eb7269e263b220e904e4555d7223c_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:70343ad0d6352ad4e6e8a04bfc76dba5656cf0f840e8651e4bf831653bad8f2a_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8@sha256:bab3d4d0ad795bb8b5e07f1473bc460d6911322f2ba43d929fcb716d563a8c67_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:3081e1b11a6ab181f20300c2c4617babff90b4fa061dba89f24e5f3c71b94c29_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:3277909d639b8e9cdd222cf875f3c8d9930f82111287e792a1acfc753db3af7c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:668db20b1ddb96e9cdd887d2ad623808d80ebaca3086b0b15c30c239452ad60d_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8@sha256:e188ed2d598f739ff4c015dcaac60df89a1c2df50ae06e3389c1cbabc6464e62_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:21abe57c756f824d9daa24bb897878bcde142430d8b780d815e55334e9566023_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:87698d1f001a1c754e8617b8618d6ef6e75078fc93e579a7323b8ea5037893dc_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:b13ee7fb1b662bc1bafecb8a80cbf09caa0c4e258c8c66030b4ac75689a2493b_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8@sha256:fb4ef587618f9dde307df362b098de3e42c26373eb8d83bb344ea1847e467fd4_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:8f2b6efc9e8be5db2e175daef5d0f95ab2bd585dc20df56d844366946dd60057_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:0f772de52e7f61abe0e18c4144bbaf2f0d288708929f0d1462934667fca86677_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:45d29cff5bcd8969fdc83dc6cf61eb8c9c7f8f7ef74604abcf2fe481a84ccb31_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:d76922eb53bc1c337cb0452a84b76aafc8b92f404ddb1ae2d6a0b45416faf4e9_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator@sha256:d9cce1e78fe7dbede26dfd8e4249aaa2b12e6f276161eb1ec4f3e660b9b66f1b_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:3a6108facf8ba76db9ebf5cdc468a6edc5c305b92c25f0013c64b8b9f7a90a30_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:b008563e865b25be2ea41f151d0262c2ab37849ed46a558d8a4f7be0c901a76c_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:bed0a72efbf5407e4b4b496aeb9f6cdc6abd9c44f9b7dccf0b297788c9b9973b_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8@sha256:cca311b28042c97639528fe096b32a3bf88e6aab1dde5884c6cd632b084a33d8_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:2f6cd5e1c78d96e679f928356e357f2a396c08252b3552dd8a20780f49332cc2_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4d996dc985d8888cc38d9b45f9e37e6c912f06f7fd10c21f3997c530ec73967a_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:c78e7bdc6e9d89d36915a3f1da96a97cbf12709ab3be4ef83dcaa6d5c557b518_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:eb611e2c05cb3d497cd9c40cbee965b1fa48eb32553aaa5bbffd55354be7a8e7_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4e5925a32d137520a161f28caba27e9bcaec0a7d34b098e4862ccbf987e38456_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:52b0908701e6671c167f1988313f367790ee4042a72b7cfc4d22b77b2805f34d_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:658740855eb57464629df0632fa1ba65f3788b1297c079d83e4c5c3dfeaa5196_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:9a9495c3e2812d7cb45e1731ab72f22170a30286948d49260b8e2468d4d25079_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.9
  • +16 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (14)