RHSA-2026:54392CriticalCVSS 9.9

Red Hat Security Advisory: Multicluster Global Hub 1.6.5 security update

Published
August 12, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (3)

CVE-2026-42306 →CVE-2026-55969 →CVE-2026-66801 · pending

📋 Description

CVE-2026-42306 — github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup CVE-2026-55969 — thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound CVE-2026-66801 — multicluster-global-hub: multicluster-global-hub: shared Kafka gh-spec topic Write ACL plus spoofable CloudEvent source enables fleet-wide cluster-admin from any compromised managed hub

🎯 Affected products22

  • Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6f2e5f0fdfee2022b20ee0dcc863f2dd7f1c625817f52fe8239ab5ecc79f2733_amd64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c572fb658b37c4629240e46dcf2512d2e26b314354736c92f610df194f08c840_arm64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:eeb2cf9ee5d4d464d99fa5642aea3f3d68ec5d7483d8c716aa16ade4cc50b63e_ppc64le as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:fd4dde219f95e134f6fc6e99dc4e5d6d307c4970784153bb907e94d62277e0ff_s390x as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:538f16143d15752f7a6753667f13e8d7b48efb34d0cff17a9f726a7de220ecf3_s390x as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:54702f0054d14967b4ef2b77ff60f76624d5a3fa3272a51e4ef35d251a1e99bd_amd64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:56d42c9fe938f916ec83ef7c93fb7e403dae6fe7fbecb5dd88fbf7e2befbcef0_ppc64le as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:6c287b461cadc451a3380c887d5255bdfc21761cd26beccd3e4e1a5ce88a441a_arm64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:5495446e8d0334f94f7f6830c75575ca8b4896309a73b7938565ec785d7fb589_ppc64le as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c3426e56534f063a26f14fddeaef9a75c2457bc11ffc7324545941925956d6c_amd64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c999e88b89c35fffdac9526dac83e28225cdbdb78a1b4d868bd401e3460dbe4_s390x as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:c1de0aac6452070560d1481b55530c441c6d3a55c215ee4bca23c7bbdaa91538_arm64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:7c855d1a21309a5a889c02692b85df0acaf936120a876687f234f97944eb8f86_amd64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:23351c3eb3f9dd1a76fbea9d18c284027e49ee0226fef279300bf6154269cd6e_arm64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:577df46c89118e93992b112cfabd1848127d3eec85cddd96dc48410b43528381_s390x as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ed372714f1fb64c2136954b842c68a9e17943c9c773b7c68da695a4062c8302_amd64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:a6bd3e7a1398efbdeaab7a57604e1d8c80d7c3263f87efb1d984d4cf70509233_ppc64le as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3683dec0e1995e5f74da731a720f67c74b03fc22f9ee4fde9eae2dfda6e9541b_s390x as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:45ee466e62a5c23465c708ef45fe2c382a511d8aab27805b9b59b0a897ea34b8_arm64 as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4e9983ebd37e06969fbc9ecc7a07dfebea6bf1b1a42b5e28678646f2a0466932_ppc64le as a component of Multicluster Global Hub 1.6.2
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:948f18c01dcf6d1525d7eab475bea09396969d8c3269ff5b5f449c6ef78928a5_amd64 as a component of Multicluster Global Hub 1.6.2

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)