RHSA-2026:19109HighCVSS 9.1

Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.4 security update

Published
May 19, 2026
Last Modified
August 15, 2026

🔗 CVE IDs covered (8)

CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-33186 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42039 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products121

  • multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:13f6c1d3e139e65a31b33eaa6270801d119312b3d549f18d067d20f70ca59b35_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:6d3f561bf0b20e21b5b9cd4991a733433aab38de90c34a78ee6c7072451b6eb2_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:a494445f6891f9654778558d761bf686547f908e166d7d29f927335ad356a297_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b37db0964b69e992e8cc3bf65af4b9a2710fbc0eddf197aca11b8757685e5359_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:0f893471cae9dfc849dfcc99a0f2b097bd03181a3b0bf222b882565cd95cb8f5_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:26ca7d0518dcd2c7740b8e26f80fe6d77437c94e5e8cc578a47a07cadad3bcff_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:72d383e2542d4abbad9637eb21471872fb47791d606098b059307f6c663729d3_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:fce839dcc1fc4d0b67331c3e84325b9f5e5c588a536270a0ea7386115e7d5767_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:3a036222708594b2561ccb94439ad40a961e57444801cce9d359fc13f65f67e4_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:612c5192f4bc23d43dd95f3a47a9615aacddb296688c0f30894e9b32c072f63e_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:7d1b7afd61238d73dbb0f3a82de2e940378b719bbb1603d8707f134ec6c89beb_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:9beaec71c8c41bab98add30b64ed7cd863421487e991aedc1d9b81331a97d3b2_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:264798d6bb5200c74ccc549c28e37663cf1841a24ae460671d0a2562fdd272bf_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:6fa22a8e16f8454f7644880a1e54046a410c5ee8dc65922d3ddb84f2ef4169b5_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:86b6c1ebba0aba5fda2158d076e2c89ee4b409d5327fdeefd96ca52f17e652cf_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:cc499ee9c906fdbe8478e0678c835d9eb48403b97faa913cf312490faa420d8b_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:067ae6af633a50e85ef6348051dce465d8f405d1c9d834e625a4e316826ca39c_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:57fabaaf793dde7e2da4a879b1272b34e5ed8a922050556235c97131803582f4_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:5ea5e7867cd22994fcfbca7a0fb6ad9513eea46421ae875eea35bd7680f6033d_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:600f12c3ae9675d97f28ea8a79a5452894055b367c958006ba8ef4e7fedd5d89_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:4a07e84760a76110dc4ecc5514fc9471ab54af42f89a42ece36de21b45baeaba_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:572d16a4b25a6870a7e98a2f62618e16a6ce861b9334467a4479afee7536ff8f_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9614feb6c796412d800cc38af86e5671f759a31ab87b7e8bfdd335a81c85e434_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9c6e847cf4a44ba9f0e16af44306dc3b99bc5b5e3195b15312db0c7b298dca48_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:1c1b0f2e2137b6cca0d05c8edf9b5ed0069048037bfe89bf846afd34c94ba66a_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:36f4e64e02c367346fa12a937b48277952aafd0e7b19625073a9522a986fcf9e_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:42cf1ea478a1fbb044206c3363a2b90a476e6dc8bbe848d9fe1f757853883e1e_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c373f0b8c76cb51b40f4a5de9eb2a17cad01e3c4552c5dad943d678cdab0926c_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:2be3d1919884cd377417d825b24f51d7b8ae9554186f0b66fd6d80a485058a25_s390x as a component of multicluster engine for Kubernetes 2.9
  • +91 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)