RHSA-2026:13853HighCVSS 8.8

Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.1 security update

Published
May 5, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (2)

CVE-2026-4740 →CVE-2026-29063 →

📋 Description

CVE-2026-4740 — rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution

🎯 Affected products129

  • multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:00e8a7b25c8f8bfe9e7b5426b8293628cdb947984aa7ccb1353607e6d62a033d_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:12c44c693c0a2e66e1a8551262c5bb6d124bdeac18b8a7397ffab5415ca649a4_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:989c6f7fc5b49403d7d7e4fb249be974219551b7738e03509013176e808925c3_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:ee9b206f323b5eaab9e2521642866823ee56ae93c940043337f7f9a4853c795b_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:30dfd76cdb4877e497971b77ee6a0319df648b2d35929b722c843ea32355ea80_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:5e1bd11d881544a6e4c15470efa140aabf0fac8a73cc8376e594f297b602b432_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:bc4952e41ce52367ae49d2ca8884bc129351358115f6921cc1a3886e28db7d2b_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:d98c06542b6b2fb932ac29a1f5179f9115880f073e0922a4a79daf18892c51c7_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2f4000fe3b143b85ccee82fddf39340c7003163bae723f01d0fb37867380ff34_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:478f98eecc5abeaa7a0a7231f235cdfe3198caf5ef3e1dbaf528b50dfb019740_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:b4f0d07946088bafb192d629554376c6bda1e0b2cdefbdc6090af01c45b797ec_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:b5adad6dad477dcae3b1c4dea9a68bac3deeb236798465b49c5ecc6a0f75b83b_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:76ba92c05b604f2951012cfcc57942595bec1f994a8af13c966968e65d9fad24_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:825bfdb223b2be40e6027956f792d336640e0f3f6719d4368675cbd8701ce86b_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:952cb8caa514f385ed4294bee9ba4242d8b8c844d5fe896d575525b1316736c0_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:9554990ccabf0f6b60adf490e001772ace34a50d47bcc355f9a3ace446eeae7d_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:506a125b4a5bf4a2ba4ee16841fcaa60bab4375a653197718f569213fc5b57df_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:51bdbd57f824a9ee2ac5e376d4bd84674691a9c11493e9a44034d922a0eeeea6_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:a0a6a0781e8f6e003564fd61dc5a580d5dea9640121f8c71f8ac88e850bec0cb_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:a6a39ec0e94ba0341f56756f8351c5318e9413b7c8dc9a19666ffa48b929f41d_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e55565ffe1bb71c672014b4994a9916e7688e89aef57d936a816e9dfa851e_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:801cb3bc4cb84e5253d774042086e4b2b703510b27cda4d82686a2df90d6427c_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:8c9ef5f6533ca7fb675e42bae241e81cd5b962d94fe792533b76e786433c6099_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d58c077d4bd1d433b92aada8f9ea2b4f25c063fa4b306fa91cf033adda8e7742_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:2b4b14c26334f4636cd6263943415cd0e97141841f86c7bac934ed754596c059_s390x as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:398d0be7df8065fa0c9b4baf75775d08394f5bfe8f44a8e2f52a5c8a8428582b_ppc64le as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:73b1ae2cd0605b68700c7f5928562c2e7bc8923c611cab9425088627afd8767a_amd64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:d33be0f681f2745a7a26293d573b068cf8a0c81df5be146f4cea364085d7708b_arm64 as a component of multicluster engine for Kubernetes 2.11
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:1cefb3b557845fe5b9eaee6142d907a4d65fcd91d5aa22ec15eba1f41e9f69f4_arm64 as a component of multicluster engine for Kubernetes 2.11
  • +99 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)