RHSA-2026:17121HighCVSS 7.5

Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.6

Published
May 13, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (3)

CVE-2026-34986 →CVE-2026-35469 →CVE-2026-32285 →

📋 Description

CVE-2026-32285 — github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code

🎯 Affected products5

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:319978f477315441f9bcfc8ecb40bde3ad84136d3e634627ce114b400263c593_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:5c3fb43dee6299526b4c48d8a4c0a551ce138ff468bec663a29b7f174f4f2d9d_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:9ed7a2abd8c1949da891af2e7cbec5fbb03a58acf76048078b03c5ead7f4d5cd_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:cf5366023df8dafdc799931d295128ea6b80ef1c84da4fcdede321dd44676390_s390x as a component of multicluster engine for Kubernetes 2.8

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.13. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.

🔗 References (6)