RHSA-2026:53530CriticalCVSS 9.9

Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update

Published
August 11, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (16)

CVE-2026-27145 →CVE-2026-46385 →CVE-2026-53488 →CVE-2026-33811 →CVE-2026-42306 →CVE-2026-53492 →CVE-2026-55969 →CVE-2026-33376 →CVE-2026-42151 →CVE-2026-42154 →CVE-2026-43870 →CVE-2026-46384 →CVE-2026-66801 · pendingCVE-2026-33377 →CVE-2026-39821 →CVE-2026-55677 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33376 — grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default CVE-2026-33377 — grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42306 — github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup CVE-2026-43870 — apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities CVE-2026-46384 — github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder CVE-2026-46385 — github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration CVE-2026-53488 — github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin CVE-2026-53492 — github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration. CVE-2026-55677 — github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy CVE-2026-55969 — thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound CVE-2026-66801 — multicluster-global-hub: multicluster-global-hub: shared Kafka gh-spec topic Write ACL plus spoofable CloudEvent source enables fleet-wide cluster-admin from any compromised managed hub

🎯 Affected products18

  • Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9ff6b012aa9cbc584c90819143176ca55b648b56c1d744c40d5a98041586df7a_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:a62de8e7ed4d12aff0caf880f3e71522ca9778bddf58f78053d3bef6ec223beb_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:e550d253bdf8540ad8825ebd43a3b83cd17fba2a53c22c344596fcdd04d4a093_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ff06c4abc43a5e345a4677ca4c0c40f9b766da47ff516f2b1ebf1ee1270a10c7_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:35e39280cdc12086575c1540a2923988659034f155235682f6830d01997d5e54_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:36257adc197f85246a68818e474c1fafae6ba1fe0be3f07b16c790fadc5324fb_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:b7bd3cb92dc58a77f90482bb800c5a8473fd86f471939a987f213211e63e613e_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c815032f2a046041adfac5a982a763a6536b1619a3c43f54f8eb6b585bbcab98_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7f216941d795567ff74dfac6afd409716e78d6aea10c7a3e0aa1b5e13adc8120_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:b5864bcb88d8ec81bd3fddda8eddc9daa52b5f8f45fb6384f6941b0bdde5295a_ppc64le as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ba8a184537b9ff6cd4a01cb924f0e5afeb3c356bda8261eae89a3b78db49ccfc_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:c84a08f5577c670c5514bc4ef899861c6b1c13f89410a4f83f08b0cc8f6352fb_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:177214dd48325183695480f1dcdf03078054836f5bcee54ff4a26233bbd8ee37_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4ab4a0d1ea1f0bd6e61b7a202311960129e84cb36a8922305a661a76ea8c49f7_s390x as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5cf6ec50135435f6626f10c57a11c76af61c5f278c04bcfaf992f3621db88005_amd64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:af5d0180164c9cfef7a111f0d27b4ab6b5d81e2caaa1a696958c02291f006184_arm64 as a component of Multicluster Global Hub 1.7.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b8e58493087705e33afe23d72ed351608c6f6ac22c304be09d279b71ce98a815_ppc64le as a component of Multicluster Global Hub 1.7.2

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, explicitly specify the intended IPv6 address mask—typically /128 for a single host—within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended. For RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect. Workaround: Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available. Workaround: Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.

🔗 References (19)