RHSA-2026:17699HighCVSS 8.2

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.6 security update

Published
May 14, 2026
Last Modified
August 13, 2026

🔗 CVE IDs covered (9)

CVE-2026-42043 →CVE-2026-42044 →CVE-2025-62718 →CVE-2026-42033 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-40175 →CVE-2026-40895 →CVE-2026-42035 →

📋 Description

CVE-2025-62718 — axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization CVE-2026-40175 — axios: Axios: Remote Code Execution via Prototype Pollution escalation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products109

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:3ce18ada2f9a154701aff42e85bd04ae208c98a2740795ba13b68b337a155737_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:55823addb648700bd1664bb58133f1aedfb65fbc74749687fbef41f1136bcee7_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:874e4ccb63bcfd4de4286999abc76a62085b7e815dd7e6ae94c1e43a3ce0966c_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:9fa3d423f4bc2067d3b5e006141069201b2ac41808703fd05d581eb920e42561_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:453c6ea090fff48b07855523ca40a2e8a3a9a8283f53b9a0ee07a8a7f95ee6b3_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6bc7241a590cd80fb92ee323069186c8540eb6a4f33d8d5ba187ef2c589d4e76_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:a5ce32fb4b8ccf9d56a76bbd97e0c36205b6992e1628e179249c62fd0a7f3e8a_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:f2db5fcb81c8b503193f9bffc6e867da79b975fd7c8c8865ad0c94e77ae2e4be_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:5ea2be3c0418cb4897de097ebd0f920f32895344f1eeac8f5e4a494643a25e87_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:9d1cd236f8c94e1ef553c7051dcd72fafd0f1696dfc83591baac66994899eec8_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a86c5ab69b5aca8df3cbdb8f195678b4dc767745c06c16fc2d6dfc2809d705b1_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c77990d5205df7d25319f236a041bb7c852adcf142f0781a97f7f2dd90aefd08_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:3ce626dda8bd0950f2ff0c063be586125641513e70de40e2765fe9133a0cef4a_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:79275891d7178bd4b611914b9d7b450e0dce37bf87972de262b1976928100a1b_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:d97152635adb4a0fbc31e60ccd968ea60b6243f08c99c8842181b565356bc427_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:f7dad30eb5ac563461591d2bad155e870678f5b538a127b3c1da137f1b466c8a_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:40e001d6c3c4fc080611625285968d4a70ca26d2c65e7b3914062203e948ef6f_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:6eb8515588ea85534b444071dda2b5563cd637040b09709da5b3b14921b36ece_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:77ee8a095399d9fca8641a5fb08b9e06031df4b63bd8c2526a6f144e0e94586d_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c283e665c5dad24e8dd28646c8c5eb5fb3afb77a5e2b299a0fb82ead975dcff1_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:0d551c761a67292a0144f5b20c9b5a30d5de1a8fb4c0f74b64dc0db38f5b6be4_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:14763b8e9ed64215f3d30bae7b3ba3d43f4c19ccf509661f586a8d218feb9a2a_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:613bb1aa4cf3d7ab00cbd7c192a8e691cff2c8592ddce0efc42dfae8bc8b090e_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:c95bfbba7e1ca8c118fc751462259cec11141f3ca9bb529111514a3e8f1b8556_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:25f95df1593ea4e64752422f0e62171dfddb5adc359289a7c6877c963d7b34d5_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:9a624bb5394c0cb2687dc2416f006eed7694588aee4b7dfdc37ae2d1bc911cd6_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a5fa11271cd6a63db3acbc960b9a832d7074ecdcb9f426cabfddc67bcb70c68d_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:f979acb72698cf6461637197b8f16f3650124bc0bc4d3060374fe25b308f73db_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:62c7309855978c992e157afa6a9423ad0a37a8362e6e8ec7fb33fcf92d49547f_s390x as a component of multicluster engine for Kubernetes 2.8
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)