RHSA-2026:5636HighCVSS 8.2

Red Hat Security Advisory: multicluster engine for Kubernetes v2.7.9 security update

Published
March 24, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (8)

CVE-2025-13465 →CVE-2025-47907 →CVE-2025-58183 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-22029 →CVE-2026-25639 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig

🎯 Affected products109

  • multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:4667db4cc9699f5e41cda6388eb7371ad9c8c73a92a7fc19115ddd48b562e56e_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:c09c8b8f588cac2b8c4b15a79de635971f002419ffc2b4d967f383160897e2dd_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:d00a17c4162336d52d47452f13d2470ddd4f9d6913759472791ee4d8bfc34d46_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:fe8b267cb2ea707fda229bae30ca074079da2909e7313eff06ba9eb2fb529237_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:76d00b37dc5c5d7bf489f55f3a41a953677449491b01c789bf7b29c789c461b7_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:a2fa219ec0da0910c1a858ac43d53288f2cf434c26fcb6cd8185e9d6f13a1ebd_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:c4e710e3ab66dfbcb3f2db4d17f73aea44ea9d2649e5f5cec94c1b51644809cf_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:c6a8bf6b7644c45a41d4c8a1c31cc08e03b6ac5ed36f562256cb1509f26a47c7_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:6ae1271bcaebb79d7dd48fa4bb89f2cf0bf450cce004899feee7d1a53d230a81_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:8ffc2f2cdfd7753c083ca083a42da60b8783d09b6817c6b22c38c91d67c0b4a5_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:9295aea24d0997fd5112e4bc6701f15e5ed2ee54f298d134aef5c9d499ad7ce5_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:fb103ee7a47badea6dfd32f698cc209bb2242dd90b51986cea6f26a03ade9516_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:8173d4f41f25103f387f1b148f9e90eba72abeccd506bfe657f6fd54cbbcf395_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e146412fb2f0d808cf6a0faa5f39e54032cd4b6c594d67795bb81883ebf0b386_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:ec486aa31c687d3f9e8dffe7ae5018b9ce3cc8795a91765c237eb72b2f6984c5_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:fb47b5a6d4fe1c966eb29109c27a5e323b6b4e665a2754f234979cef4bfc6fc2_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:111a02c966b528a619c9ad5942151e64374e0c57d80be21f91c0f41469c63c19_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:1396ea60940f7dfc33d67d918dd82d62f780d0e837e12785ccec2ada30ce3f93_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:4c393e89346494a9abd31c664e977edacd6ca8bf1f1c28c2aa9a6625f0d02d9f_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ca4d807da014acefb7e963000cd2431352087dd908491ff4189592f53dec93ff_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:694ac8be10bee34d7c34fdcabde7dfdf1558053cac0479eca4677971c09589e6_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:c0b2cdac26577de087dfd119ff0e2f996f211cd9021bed43d01e286fe166642d_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:d35fb00e5d71a79ec679d7bb9911c4974ca4ebe334e76461270594feda1a7378_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:dabdf0f6fec7ebd5b86034281ae740aea0e77146e33bdd04c01590745b68ea8e_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:6e44a95fd942fad8a4f43379d100d2f11808caef975afbafe244543b2f33e2b1_arm64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:bbcbedae29915aecb2d0722d16a5265b214714b2e8695f4885395982507950f8_s390x as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:f02386b7e2476ab45ef771bdc6034ba4148bdbbf30cb95e2110a681adaeaa03e_amd64 as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:f87238bec802fb8e8aa257f73eb32f3b3cacf1564677e594ca0d165ed2c0a021_ppc64le as a component of multicluster engine for Kubernetes 2.7
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:2dc8a21ac845a94b55a048554052666910cd7e5fc2f9731d62c8911f18ac3fcb_arm64 as a component of multicluster engine for Kubernetes 2.7
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (11)