RHSA-2026:26254HighCVSS 8.8

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.8

Published
June 16, 2026
Last Modified
August 14, 2026

🔗 CVE IDs covered (2)

CVE-2025-58058 →CVE-2026-39883 →

📋 Description

CVE-2025-58058 — github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory CVE-2026-39883 — github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Arbitrary code execution via PATH hijacking on BSD/Solaris

🎯 Affected products21

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:5afcb0cd2a9c693cec0839deed6435c69abb50a4a50e5e55a69d3f553806bbd1_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:6c5c5c4686bfc5cc9bbef1fcd990ee72af1080796cb0849ad006b6673a05859b_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bc2f8ee10452ea3e4841fb5c9acffbb820c53b329527c8580afccedb2a4bf37e_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:e9e0e699e9e9acf9645f1e38f71d08ba1711066c16d10f1b6475439c7661dcae_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:2b436e18e98a63c98ccd5aa4e5315a4e8d7f9c6f0d1ba7ce36cf1f445ba6b213_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:8bf11dabddf6d4784f1c397d300d953ffd762ef3db8b823971577fbef032a15b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c34bb03b1038bbed1e6f47c2105703ae2214c772467ac2cea733cf6b2bd5572f_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:d040d471b0b65a4be2d71e519cdf05d9040865a0889960335709d7f10b504e59_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:1aef2fa08a49510813e8cc149cc737c09570c4c94d4441e846d0abdbd97b434f_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:b94a3f3ad45af3d4dd10498d5e6906947c72adc1361e50bda9482ba954e6567b_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:dfcd7d76bfa892b6be2c2abd99f13bd7e58d2ca82ea99bf2443cec9b888fd918_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:f3379b9e6c08cd00abcf7be97308b7ff2354697407a026d5f08e942b47ca7e08_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:458a6eaf23dc717f6988c94556bbbc224dcd2bbaa7573aed6fa820086f9523fe_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a382b267318a49d9dc29d704afb41f188edc15021d267d402203fcd10722dd5f_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:ba3b4da8d399b387de1047cd7952224d0032c3748d12928a9b7eda776df8a38a_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:d301ef6d274f4127b4eaf7ae78d2dd8af51aeebf999dd8624d20cbf0ba05864b_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:228e5cefc1e32500a2b244ebeaa4b700efed644c5e266a6b3d139e23a6d1113d_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:2b9e8ab86b77035917aaa673ecc311a0fe0be0687c65a3e000b9e3dfe3e02bb7_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a11d75aec4913b0643f7e74d4138c9cfa19b6ab4c6280519948de935873b4570_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:bd04b7cfba87314171b1ce6113b0cc37b386a4bf30ae2f9020011ce002c6e933_arm64 as a component of multicluster engine for Kubernetes 2.8

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.13. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (5)