RHSA-2026:47149HighCVSS 8.8

Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update

Published
July 28, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (13)

CVE-2026-43870 →CVE-2026-46384 →CVE-2026-46385 →CVE-2026-55677 →CVE-2026-27145 →CVE-2026-33376 →CVE-2026-33377 →CVE-2026-33811 →CVE-2026-39821 →CVE-2026-42151 →CVE-2026-53488 →CVE-2026-53492 →CVE-2026-42154 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33376 — grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default CVE-2026-33377 — grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-43870 — apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities CVE-2026-46384 — github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder CVE-2026-46385 — github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. CVE-2026-55677 — github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

🎯 Affected products22

  • Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5455508edaa16f31321ee2338d2c96bb2332a71f21c0cd562c234faeef25dc48_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:766b01214c66a82c68a5f06377654690ea0b96f2ee5ba82fe915ade2d5bf3768_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:d550343f6f29fbf6bae50c1de593b74767e4264bc58dddc20d5d42488f731164_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f02c581ed6d50d3c90679415312311ff1501c2dcc5178787c18490fabcc5d72c_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:07403ee94ddd8865391d250604378ff9450b9f32dc1ed8900231c9debf09670d_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:45c1f1d1a4a678691502a2924783ea2fe8ac3db24673d8226b431c99ffa8ce8a_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5f911ac9d4d46f2abb9879e00db004ec723b65f52e23e15f8228659fc047b3ae_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ce99eac074e8f3b854457b0367e492153a5ca05d4cffaacb68700f443b5fc6b2_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:438a4489de862a5c1d4c85f053d58ea3d6e6a24ab86459d72f311f9a08388fc7_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:98beb62d0210feae487ab01fd2b8da683ce8e59bb247b50c51aff6e17bee7577_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0c3e9d30c376e4be1f42d9aa9013d386a2c8b37206126a71c5205f79e08e34c_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfe732b782f2b544f43a25b36ae0d3c66e7f5edba843985991a262120d465bef_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:ad27a9346c1d7d31d6873a49f49c2c72e8dfd52b9df8d44792f34a8851cbf8c9_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5969d9f76561444d05bc8ce5ee49ba5c8ed978c0ed3bdd5fa435dd2d2e39e12f_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7174d7a9171c4ffaf36782dd861747e4a5e74b9dba4a4872a2fae34bd410eea0_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:95194e8c4eaf49d480520c314c35cfaa6d9c80ce0730b4116cd5660e7f88ace2_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b009a8752b812631585cadd6bf7ec23274ee1861920cf82eb838625a96799d5d_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40cbdfdf7d2ac32ea02a5223c88f464099a5316cc16ff706e41f821977d5d030_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4b0e67367dbea7b48e0a3862d5877f7a648bff457c75a3c1f52f4c75f608a54e_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:aba5ed6470389ad2f83bf9bd87c19c1c4f12c741f366c02a623bb21c819cf0fb_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d5787b4dba1bf9ac862c4dd323cf46cfce3276c19a7a415b89b1ab4dcd3a184b_s390x as a component of Multicluster Global Hub 1.7.2

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, explicitly specify the intended IPv6 address mask—typically /128 for a single host—within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended. For RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect. Workaround: Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (16)