RHSA-2026:17657HighCVSS 8.2

Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.11 security update

Published
May 14, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (9)

CVE-2026-42035 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-40175 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42043 →CVE-2026-42044 →CVE-2025-62718 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products109

  • multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:08a6b5c85d45dd4309a927b4e1b30de502d0c28437a7c0726b66c559e5043021_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:d7c14518968725f71ba80aa1cb9405d8fe26647f28df271950d443c990f8d1dc_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:dd25d129d741ced07f790ebdf0ccb1e3b7314f96dc4b7cb486ad0aeea6466fdb_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e22baffff7bebd58a77056b93dab79d1f0feb9a5d9bbd1fe6349cc76433b9320_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6bcb806ebcc74b173fcd864561a170982acf786a795bd8f76b8a77ef97abb148_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:a2d4b7d55beae72d0b1da79ad166e27aa3a6b672c339c8735bdebf2be1dee818_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:c3f46f77096c565014cd970ed89d4112f3ae27722bc317ad8c2c5878919294ae_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:ecd928574e8687e9798cc05f9b1aa852559b6d9d4d92bfc3c2dd00622ad2a54f_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:391c658a7e1809989274da422175932c73dafabaa38b85aca43467669ceb172a_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3ff39b22fad37e54032d3b38a8162ac21ef4ad03ff3f8956523c4b60abc0b008_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:80347cd6894e6b6a0a5c99e93f4696d61a21d944b1cc83b97bf94f7c03281d76_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a883f9282d52eb86200a200a007689d36748bd2bf3831bcf3590bb2f6690c5d2_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:70e78ee64f2af10d4d129f138e9eacb8e2ad7ab432844040f1e94e4db9251c78_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:70f0afbeaa8663b8beb7ab0418062c195722ef1eac7c2914bf8503cdfd518aed_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:770168c39fcd48db0e8e019e7236294b30177ad11fba033c38d3ac613fa67816_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:aa04cf15c46a3e4f96f0fb7ccf1a8ba2bad79662bc1a72a28c62b42b5fe55a3d_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:1720b7841a39955b2c5e96c31a689d1e408319b680733f87fd46b0ad5be20e14_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:1b314d43aaf0e3750baffeea4700c38861218d87827142ec83ac5b5b57882e98_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:6631686d9a98dfab3309f952b6c012a030c5c6aa087fe50914d9f063d8397b7c_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:665c7e8eea20ecf6dc56ea1c9aedc28241a0b6d38aa240efdb4c06cc93f4482f_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1bceb224cf658470a1b1681e23116028ca18c7809b9890b3be5ef4e8aa17dd29_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:4025f17f4975463a5860d0235ca2e9d81c031a9b9af624a119d2f6cd95e0440e_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:59fc995c9af1a7b257af9f2c7701302df3f9dd70de43ca41691da91f0a019dc1_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:bec3af86481d1f2b75f38caf42e8b5936dc71207eac6e501bc0ef53e79ad7359_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:6ebbaec36fd8d17de455c6c8d286644433a7f83160066c07fee4ffcade21f7cf_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:7f7f514b5cfeeedd50960100e9ee1cc90cd4e1179e661ea51fbd782bd7ee7f10_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:88b2c827b5e343204295168e6f524e41ec6699cc14fe2cf4016c58aa9b8617fc_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:c1137d1d5db9a9923d938c4d76fb6b9ee2879e556b92fe26671083ef49d05fca_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:9d8c1341da89a60f900cd5401a8d04f2e277e58878c22592dc199336eb01a84e_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)