RHSA-2026:22260HighCVSS 7.5

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.7

Published
June 1, 2026
Last Modified
July 31, 2026

🔗 CVE IDs covered (2)

CVE-2026-32280 →CVE-2026-34986 →

📋 Description

CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products21

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:18b8d484378161bc70f15f0e0148a1c4a54d3c3843b676bc4de766ecce005602_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:59781441af0a7b8dacb7bd3e96f145708138cc42d1bf35ad0d7be5309a9dd527_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:90d322c01dccbd64c89b117926db10355216a926448e33b1998b73dcd52c1701_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:dddf9226f3e958a2d8cd9a34c57477adbdd85d87be8a416ff17a79c28656208d_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:199c0dbad44d8e7aec185a017c06b54472efd3ccba556c6a7d1f43cfe52eaf83_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:4db21d9cd00d79bbab581beda640d75b80113cd0d3f3bd2592fdaeab8572119a_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:6f10fd242bacc0304f5e485b0caa779a9ddee62ff7511f7a2d02281745b9b832_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:7bd1972beb9149061fd238e6f5802bc90ac29cf46abbeffb1174c00da99c1fbf_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:9ccd98456ed77735b40bfc15e60351c1392cf7a5fc43ba19c6c9535d40889cbd_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:9e8cfc4f388375dd3c925dc4378bf703ca8a4c8b1fab7b1265b90940bfbe34a3_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:a013400acf243733951e70e9c14111ade95b8eb6968cb7580859ba33e91c0b3b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:b3fe27ef87a511566ae28f5247df9315e1f0809fd78d4a767494decbe960ee21_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:0c50fbc44a442c810d1c9999d3d45e858ce4c9b49ea047bc80a691a7b23e8252_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:7036633b0a8c627df65b1cdcd1b9ec9acfaf3d621a6125bd7d24e0c0a88b5a80_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:7541aaa488c30653e5ef3738c3bbad68aa32d62b968cbf82225f658ce073ee08_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:c84ba6175bdce3b74458c3831e8d01917acd5f3599f47a54936b6331063c6da7_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:5a9521f8da26d292b340af25e3aaa6813ccbd332447530011ba0197cb922c683_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:76f9aeb931bde7710f763310488da882875c7e0228b1da41d1c74f24e7d1b2b5_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7f32362ab1f5f8923f326ee2e3711c156848803a0c3a11d5740d8206eb93b98a_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a94a7be1120a24a70639cd6352204a1f496c71c53acc45c2730486dcde5c6869_ppc64le as a component of multicluster engine for Kubernetes 2.8

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.13. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)