RHSA-2026:24536HighCVSS 9.1

Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.3 security update

Published
June 8, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (8)

CVE-2026-33186 →CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42035 →CVE-2026-42039 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products125

  • multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:02108938c522fd0b64621faecb7b789902bcdfa18095ac6f262db5287425722a_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:1e3edffa1ab72dde13913855a5eada827f7de04060549d2cb4de08db4af50ee6_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:3127d8373af938faf826f0b0aaee3bc639d40982c1b9d9279b5f7dd6d62ed3c6_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:6340832d30f05f37955f30ffeed4717c9f63e0bb06f30c226c00eaf4fbf73cbb_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:11919013abc01f49a9315142b27276c3110f3f766b701f0db736fa6396830ffa_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:860c1dbd366e7c9776e6db59f905766c484dfdb2a271935b42aaecdd325c7e46_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:90acb9d27d4b505390f1182234749c7982d2eb626b75137d8ddb74da68baccf3_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:cf0c6f868353cf2fa5c14101210395f1bc3e425cd679c93563cde0b7c1abcbf5_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:57ca790830627d0cc65dd39c8ee085155a69416d27d893620ff5bead819d4a43_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:a155ada9a64ca2eeae7fb94247971e1a7f69b24bcfdd694d4f06dd1ee6885166_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:c909d39051f07965668870e071022b8693ad542488fe150ff7ec459e77bc5b3f_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:ce9582444bc81c6da8f5e729d1a727bf83b7b8c384cf4f65dbd4bbf85a1c9ddf_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:3228026c2de0088b511f5bf5d535a99e93d6c6d8e6533ca427a72f0e1fd2bbb0_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:4aa7496bd399acebd5f6e50471d71faaa399d205b322cf883d31644ae6862ad5_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:6a8295bfb120d2c1478e724d924a7e35db3172c3c2bf698513e5cbdca96c56c3_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:f8003ae8fe5acee35e286a82ab7cf2d77d5baf986a201fabebbe08a06446814a_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:17da45d53271be34b0b8abe64d86a7cd91859f1f1941070f18aafd3e490fe402_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:3489f13823781eb79e69f053901d818674acce4ca9aaaab8d82b2fbcdd2ce40f_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:f4db53fcef673edf24a3046d011ef8ea33a39d70d1be6afe136f0005f9ab9f44_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:fd6c699a6e9f7fc8a5dfd9dd431f657ec475ca0e9b3bf4abb10e1ae6e30392b3_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:0a7301ac13b60f1ceb69494563760ef254a901057f52f6da7d14e6ee01ab8f06_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:946a892db9e65809e79e1a39811114323a74aeea711f5dbe9a7f5517543cda0c_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:adc1c08d96fc37745aa52df717a8d411c2e31fae9bc4d316a4e79ad644f06ca7_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:c06e764e683c72ac73b264631822a157ab6a4ab15d276988ef909d88a6ee478b_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:31f5f593389d4dfa002120bbe8a72314a4398f62d1940ccfdcab1dad09ade8eb_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:56c5522393ae8cf972351eafd044de93095b48dc6804902da3dc909423071984_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:bd3b80d7d9950a256eca0c7997422383117ad4ad6a4d27f0f155a9b9a7ed4b66_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:d3918aa8bd311220e77444482e389ec885cb2ba34ca30003e113072844f2e87a_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:0ddfaa7c34653febeaca2b5101e48776634719f34651cc4f5d2e6292807f34ef_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • +95 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (11)