RHSA-2026:37252HighCVSS 8.8

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4

Published
July 9, 2026
Last Modified
September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-53488 →

📋 Description

CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin

🎯 Affected products21

  • multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64 as a component of multicluster engine for Kubernetes 2.1
  • registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le as a component of multicluster engine for Kubernetes 2.1

✅ Remediation

For more information about Assisted Installer, see the following documentation: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#cim-intro For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro This documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.15. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (4)