RHSA-2026:25271HighCVSS 8.2

Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.0 General Availability

Published
June 11, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (9)

CVE-2026-40895 →CVE-2026-42033 →CVE-2026-42041 →CVE-2026-42043 →CVE-2026-42044 →CVE-2026-6322 →CVE-2026-29181 →CVE-2026-42035 →CVE-2026-42039 →

📋 Description

CVE-2026-6322 — fast-uri: fast-uri: URI authority bypass due to improper delimiter handling CVE-2026-29181 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Denial of Service via crafted multi-value baggage headers CVE-2026-40895 — follow-redirects: follow-redirects: Information disclosure via cross-domain redirects CVE-2026-42033 — axios: Axios: HTTP Transport Hijacking via Prototype Pollution CVE-2026-42035 — axios: Axios: Arbitrary HTTP header injection via prototype pollution CVE-2026-42039 — axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data CVE-2026-42041 — axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling CVE-2026-42043 — axios: Axios: NO_PROXY bypass via crafted URL CVE-2026-42044 — axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget

🎯 Affected products129

  • multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:4a7618d5db8ebb99bf7b4e3ad04094af43c9e6df1786461b47ec073dcc9cd377_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b9937506a9084f4f118a97daf64fb87b5850b1f949faacf3c0411baa5c4ca9e6_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:edfa8ed4cc5542b9788e1316619ae6fcd23c9031adac8e92e699e067a9c3284a_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f818d31f2a5f02acc70a4649e26d3f59b0b5575d224147b8de346d452ee281cb_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:3d352a0cd99674805519d555d570139d4304140bc7905bc59e707eccceb0252d_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:651b4d2803c98e3e8727548b0ba1203fc32be94506d434bb547973f3befe4198_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:7e59e2996bc7aa27b50a45dd2b3b1c68f6ac22ccf452bb7a949bbda55eecae1f_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:89f085933171247baf25be3e2856b02953b4993b218e3072cd72e6cac539d395_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:4ab93f9962185759587819cc3d07bdbb04d94cee0e77b1e4cabb205b533aac98_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:54ef94f909b48755e1e9e31dfbc82fd2e1727c35da4bc0934831419179c5fe15_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:97922e51f5ec20ef75caffcb6e1682fd9f88c412d2ec609748a38cfdb0de6d90_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:a7aafe64229ce6c39eea7296a1477fdb1da231e97ba6639eebfffec077c358f1_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:28eb4b8708dd771dd510e6cfb467585029fc7b119b12a7be3fe31029d9678617_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:3e6e1b7cde8c7bc31db1ddd174d97e8ed73197023a0ba2bfeeb6d2aac1dcde52_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:6a4306d418ef951af9f5da974485adaf91dbbe1318079433b1ffd7869d1d7920_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:707b804536bf3739cacee926b4035398c34ff63b9b5786b22742ea2217a837aa_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:2bf2b66a204bfadc166ef7095aee2988bc8d25948b91852c2490b5de434dac37_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:5d48b1dcf5cbb60029741a0682f0457596160796b03ddb0c2a03ed056dfa74de_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:f8a43244b1c0ff8ff65276f74fe0fc431fdca3139759653c9e0efd279dab365c_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:f8be07e3fb3a0d5894e1605378ef63b66671ac5b05ce5eeeb78020d4879ce524_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:0031c1e64d48550ff346541678b3be7379c65d506159c3e9a510a7dfe6705af5_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:b2ea49fc328e3965fd6bee8b3f21d7c36849282ff21f12c5bf682bcc1fa33a15_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:bc70554264a572099e4f287d4c3dba7755f2da91f2172567de826d0218cc01b2_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:bd9f5aa386f9b3845db93c3552e3b8b1509ab0206f4a7c1c515b309aefa86200_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:07f82a8e235e61625d23a87dacd4eb9bba2ce6f9b4492b8fab92728b3465fbd3_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:68f647dd32f24cc07c30cd7a58d10ed2b0b58b23f4061621396c09dfb045ac24_arm64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:80e356b4ccaa3e27669500afe26efac1349c0ffd7bc45c023344536bd31d5725_ppc64le as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:cf5946d8186774bae01b0191589e80103e46f008e0cd812b19f9eeaa1a24e417_amd64 as a component of multicluster engine for Kubernetes 2.11.0
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:2f54b76c48601bfe440f5f0c553a3fce765a3d5be99f8f7a1d64c792abd9b63b_s390x as a component of multicluster engine for Kubernetes 2.11.0
  • +99 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (12)