RHSA-2026:23345HighCVSS 9.1

Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update

Published
June 4, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (35)

CVE-2026-32280 →CVE-2026-33219 →CVE-2026-33813 →CVE-2026-40890 →CVE-2026-32283 →CVE-2026-33215 →CVE-2026-41603 →CVE-2026-27889 →CVE-2026-33217 →CVE-2026-33810 →CVE-2026-41604 →CVE-2026-32282 →CVE-2026-34986 →CVE-2026-41607 →CVE-2026-32286 →CVE-2026-21728 →CVE-2026-32285 →CVE-2026-34040 →CVE-2026-43869 →CVE-2026-33247 →CVE-2026-33487 →CVE-2026-41602 →CVE-2026-41605 →CVE-2026-4427 · pendingCVE-2026-25679 →CVE-2026-29785 →CVE-2026-32281 →CVE-2026-33218 →CVE-2026-33413 →CVE-2026-33997 →CVE-2026-41606 →CVE-2026-27137 →CVE-2026-33186 →CVE-2026-33216 →CVE-2026-41636 →

📋 Description

CVE-2026-4427 — github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message CVE-2026-21728 — grafana/tempo: Tempo: Denial of Service via large queries CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27889 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame CVE-2026-29785 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-32285 — github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input CVE-2026-32286 — github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33215 — nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance CVE-2026-33216 — nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints CVE-2026-33217 — nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace CVE-2026-33218 — nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port CVE-2026-33219 — github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets CVE-2026-33247 — github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments CVE-2026-33413 — etcd: etcd: Authorization bypass allows information disclosure and denial of service CVE-2026-33487 — github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33813 — golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing CVE-2026-33997 — moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation CVE-2026-34040 — Moby: Moby: Authorization bypass vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object CVE-2026-40890 — github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input CVE-2026-41602 — github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation CVE-2026-41603 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation CVE-2026-41604 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41605 — Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability CVE-2026-41606 — Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion CVE-2026-41607 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41636 — apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion CVE-2026-43869 — Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation

🎯 Affected products22

  • Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x as a component of Red Hat multicluster global hub 1.6.0

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Restrict network access to etcd server ports to ensure only trusted components can establish connections. Implement strong client identity at the transport layer, such as mTLS, with tightly scoped client certificate distribution. This will limit unauthorized access to etcd functions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (38)