RHSA-2026:22258HighCVSS 7.5

Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.8.7

Published
June 1, 2026
Last Modified
July 30, 2026

🔗 CVE IDs covered (2)

CVE-2026-32280 →CVE-2026-34986 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products5

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:0578fe32759bccad07a8624017ee4629a21b3623393af20cc16f0819a0d71cf1_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:77ea535479c2c3e814107d03bd79f670c7c8ce641ff16482065ac7d5a9d818c3_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:9bcb737b6ba68fc378edaa56d3b20900807df3f463c45628f4f2bc12d099b03a_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:b9ffe0abc4785e59a27e0a0d2b6e0c6f9242a73691800252d1c9741bfcc389b4_s390x as a component of multicluster engine for Kubernetes 2.8

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.13. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)