RHSA-2026:2500HighCVSS 8.7

Red Hat Security Advisory: Red Hat multicluster global hub 1.4.4 security update

Published
February 11, 2026
Last Modified
August 28, 2026

🔗 CVE IDs covered (6)

CVE-2025-66418 →CVE-2025-66471 →CVE-2025-68429 →CVE-2026-21441 →CVE-2025-12816 →CVE-2025-15284 →

📋 Description

CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68429 — Storybook: Storybook: Information disclosure via unexpected bundling of environment variables CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products22

  • Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64 as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le as a component of Red Hat multicluster global hub 1.4.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x as a component of Red Hat multicluster global hub 1.4.2

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (9)