RHSA-2026:41055HighCVSS 8.8

Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.12 security update

Published
July 16, 2026
Last Modified
September 28, 2026

🔗 CVE IDs covered (12)

CVE-2026-39828 →CVE-2026-39829 →CVE-2026-44487 →CVE-2026-44488 →CVE-2026-44492 →CVE-2026-33811 →CVE-2026-44486 →CVE-2026-44494 →CVE-2026-44495 →CVE-2026-44496 →CVE-2026-44990 →CVE-2026-39821 →

📋 Description

CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-44486 — axios: Axios: Information disclosure of proxy credentials via HTTP redirects CVE-2026-44487 — axios: Axios: Information disclosure of proxy credentials via redirect flows CVE-2026-44488 — axios: Axios: Denial of Service due to unenforced request and response size limits CVE-2026-44492 — axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization CVE-2026-44494 — axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution CVE-2026-44495 — axios: Axios: Information disclosure due to prototype pollution vulnerability CVE-2026-44496 — axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name CVE-2026-44990 — sanitize-html: sanitize-html: Stored Cross-Site Scripting via HTML sanitizer bypass

🎯 Affected products109

  • multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:0285559d1ba4a1006c38fd757489e78c0edacb5bc42f1037f59cce2dd6ef9e9c_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:1692f5d5ec43b8c908243ac6f8628d17341933f25e1e5a53f5c279a2d93e97d6_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:c1d92a020bae5c00e04604f0ca6bb3f7d327410799c1332e9fae7786bdf1fb29_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e0abbf7070dc25c3e7ea111d3672bb2575db543c39809eb30516a5dad9ef4777_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:21dcac3a8dcfb4dff05ff5273153795dab78538d9bb0fbb409ec0cae27ec5ed1_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:691f27b75bd9a8c7882a458e309b67bd3389b5fda5f0fc033a7a0d1862ceaeef_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:fb99b59a92ca15d1d3d9b3118798400aa1a03ee2a5acb0d12514d24f4219e342_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:fee47818a0519d73c949c6c9a6bcfda18efb6471931a38d64fecb082473eed02_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:48ab4b1d5decfa1b2dfd24632d6e175c090372469ad31db1eeecbd96532005ac_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:631dcfe7186760eb5120d7e45e5ff0835d3b42af5d16aaec1314aa5e35682cfe_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c4a63170383e42285bdc7a6018714c30553887897af4cbfb8ba9894a0da0e04c_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c6f49643d6e7d962af0a57505daa1b7e2be10c7dad88ff133f46852e1649b206_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:374a9ba07f1330bda74da5b12e898c167d7d91f8513fed48e6286ae497b39acb_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:3a8c46f8a3e3cc59760fb60671df3b79e9b70a04a8f3c742134ea1108b502ca9_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:4f87f731fb1b6b67c8c97c5f434ce9ccd6da12692705d652370db53cecc746bf_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:ccfcaadaf026f1642b7a881f311fb4f55a1abc09ff4e6e2b015349f20cce3df9_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:05d778ebb19276e2dbb39c22fb34415aec928acc87959758d7067da96cd00b24_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:0d1350e34aaa7e96877d25666ea0f22362723bd8c68984d65b980fc39de43066_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:83c51872c53043658a1e64c98a77604b74c0f7e0cb0a6f54f71424fc315a3219_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c6b986d9e03fd12126d194c2ddcc13a6fa98f0789c28dfd0304650f0209cf26a_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:154459e62ea84d004652587a03ecb71adea0918bfa044646b0fd3e82003fab83_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:161d457e3aed4437e37aa7cfd96f077b7999f591f934fc9850c3b1554de74285_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:25c7116334e181740640abc5babf13fc809ae9932fa8d8a2b2354374972321c9_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:3d89333e086b36d069ab8581db64724386cc412bdf15153f3ae0b26ef00ed572_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:1e24fd0382dd41b7226d70f43a4f206b0fcf58d5ba809e7256c9eff8a9d9be23_arm64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:2c690ad55f18a59ae38e5f59578069a12b0d59112b765170a6ea48052e622109_amd64 as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:5afad0562224eb2846f0e3ba109e5e266739a7f33d24950857cff4f2fe672537_ppc64le as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:8ae5f450e45b8711935e2e300e74274d48ba013621dcd1ce37145481ed5f132b_s390x as a component of multicluster engine for Kubernetes 2.6
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:7255ba328e0588c7bee888a5c4d0bc5bcd8685a909f20ddf7aaae9439661513e_arm64 as a component of multicluster engine for Kubernetes 2.6
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)