RHSA-2026:2571HighCVSS 7.5

Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.2 security update

Published
February 11, 2026
Last Modified
September 4, 2026

🔗 CVE IDs covered (4)

CVE-2025-47907 →CVE-2025-58183 →CVE-2025-58190 →CVE-2025-61729 →

📋 Description

CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58190 — golang.org/x/net/html: Infinite parsing loop in golang.org/x/net CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate

🎯 Affected products121

  • multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:bcf5e63aba5e78b6a41dadcf73b70dc9940380c232cc2931b5da3ddfe2ecf8fc_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:cc10845b259f7ac1cae5b254e090d52fb9278c89d07b0b7d44a8f6f704ec6272_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:de69593578d899842a0e98781f9c3d58338ee0925fa0b6243aedbb569a64cd96_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e4e7e0b3fc069d4746f6584047f8b40cd774b2556f11c2cabb57923a44ef389d_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:10981e0c7a156dbfd3b8cec809c618773f3d7806a2a24c0fb1cda2e93ed6ae98_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:31f187246ac7da245c160b3afc5f1187d82cd2c039f85111a338165407d7d49d_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:a498c21c46341a168e51b133e07cd390d7440c3d949ac4107cd829c5b30a4614_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:fd7b341a1e55aec25f6e3221f03d140561be81a230590907dd74fe1a021df006_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:0180391fe4bca530eb5678bf95922d10365b286279b966136b67bf8d83a9a18c_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:4ea287235d5dbf2385f4d217690b54cd5ce56820735ae96d66ea03d86d4426c3_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:6eec1cff0d514e343599e9c3ca7b7aa2cbff307a28e45b19364a534be4f89dd1_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:e9d1e97601e8eaea73943489e782482703310d2e8f22a9fa234b640fcacbe64b_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:7b5496adbf0b53964790dbb22c468161e6d873912eacd00b08b955c1314d52a8_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:8d86d2d4ac2459d61a1e493603c9eb7a3f0d584ad53aca2af884bf8bb8b30e71_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:c39a384c11e5242dc4b25fdd32813b4ff408b188af76df03e9757796fbc7a001_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:e0137ca5fd87bc47473fc0fc4c619ea794fac6156d84f7f4fbc689fe3328640e_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:01a0a5b524624b960339e6d40bc92eaf666532b7905b8b79a31a0ad512336f20_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4285f5036dcf7311bc378bbe350dc33759254999de205929de90a9d218d32f78_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:b2f27f77bcbb85c3a57d40c14928a3922877270f4748cb2d03abfc4300f1925c_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:e5ca54ae610b6fdd062b22d68e04e8c9638a4afe9df3dee7316a09a4a50f929d_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8f10940b7e9f69bb5f5bb40fb4575f24fc8a2f20916615d6af4eff36b0dc24b2_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9e4527837150c9054e9f5eb594d557fb4642b86f1dfd109897ea63b5ff5984dd_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:adfeb1a43a5b626519d6c0aee7cd7986d5afd349a4fae37d0e8821667f7fc6d3_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:d9fecb5eebf1127819cf7a3f2c2b63e050cab8864c51d4dbcad4d95921a9b698_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:0bf1c2e7d2204076757c8bbb922e11feacedcefff491bfabf481d4c27f310448_s390x as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:437680b6193c0cf77c28cb2124e01a33b7dd51063366c5781aeaf339a840b056_ppc64le as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:cc587469525f61858f261cfbf862608aab1509bf3cf5c1e43aea63a19e579728_amd64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:e7dc46d30ae833d7924260391781b20ffc25693073e1a4b60266caa6bd725f90_arm64 as a component of multicluster engine for Kubernetes 2.9
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:0712ee64942be9d307a5d89d5333a968092a685fa71c88c7eabe1498e2e3a915_arm64 as a component of multicluster engine for Kubernetes 2.9
  • +91 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)