Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.6.11
🔗 CVE IDs covered (1)
📋 Description
CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
🎯 Affected products5
- multicluster engine for Kubernetes 2.6
- registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:0d27fe585d871bfdd39e6ebf5331fefa0def39b26e1cb970fb0800f0db445f33_ppc64le as a component of multicluster engine for Kubernetes 2.6
- registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:774895edb217c0ee78a0b3ca0063077c1d6db0be7fabf2307491d085334df7bb_s390x as a component of multicluster engine for Kubernetes 2.6
- registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:d33bfbf1e1978964c03159d0b706b84befc89d3ca10ca096883d98fd422bea31_amd64 as a component of multicluster engine for Kubernetes 2.6
- registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:ed5fd01f74d9f160ead69aefac5b5286855a7f937860e76b6cde539599b066a2_arm64 as a component of multicluster engine for Kubernetes 2.6
✅ Remediation
For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.11. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.