RHSA-2026:6226HighCVSS 7.5

Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update

Published
March 31, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (10)

CVE-2025-57810 →CVE-2025-59343 →CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2025-47907 →CVE-2025-58183 →CVE-2025-58754 →CVE-2025-61726 →CVE-2026-27571 →

📋 Description

CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-57810 — jspdf: jsPDF Denial of Service (DoS) CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58754 — axios: Axios DoS via lack of data size check CVE-2025-59343 — tar-fs: tar-fs symlink validation bypass CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-27571 — nats-server: WebSockets pre-auth memory DoS

🎯 Affected products22

  • Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4736201438be34ef50de48b9a3d66db5afc5e5831f43c03b0997868601f6a9df_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4bc7e3ff6dbf302216dc178f810b05d7a2111dc282f0f750756cf0bf6087500a_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7a15c7d86a736b47e5622eab05a3afc503211987f6f43a3dbc84e78bbf669571_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f244199ed6bfaa0b2402a94d1b68b7249cf3eda9d0147316c3d8879d1f897986_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:035d205705b2efd62713bea9d05cffdc5db7a437f050c4a3e3f12746b05c29d4_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:3ad24c00931c4024f1acf777d5b4abe874fd90f41a7d16053b11b0a24542ff97_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:437e02ffbc088d65e6697c2fd1d45ffd52c24828846a793661eacf2a26e297bc_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:b7a0ed5f55190d1688180a775074916bb6f3a4cb4dde71b48481c9858b514b7e_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2e122bde4ebe81137cc444ee6f320bdb9ecc44f04a6f7cc8bddc4118cefcf93c_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4bc6678736ae57b9980042fa1890226fa0e9850c780815ec641425af6c24c121_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:78651ded14b7828ba304579cc335543b993b395d0725c1980ea388b2130076d2_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:cbeb3fb1de219e3e515ba7e02f34836ebd1717d2dced4a6f1f46058f57e6d5eb_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:9ce0cdeed264fe07ae4372d898bf4842aa54983206967748d00bdc835555d25f_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:239e83fb26062ff6f3f7a50e299e54e272e6342660bb3f387f952edf9e354763_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:39c70f4fcd2ad2bb8495de3e748f8ec60d0dad9e2f7e4d41ebcfde777d99cc0c_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9d6c8bd778da4dd6e45730d8a6c00b8e24e930de6c7b64461d348315495134f4_amd64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:be5fe7a5bb171515bbdd7f747f76aa0cf8486ed62f7a1ee80405b602a810aef7_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:48c808f50398202bcac609f760af2289df8e190cdf6c51165debe4354602573b_arm64 as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b59011fdb03a6f9696d6a27b35fd05f0cdb87243e4aac824a309ff8e077361c6_ppc64le as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b5eb668bca1c305eb096d72da69bcb7588e5da5ccd4a6ca765f9075f38699a7a_s390x as a component of Red Hat multicluster global hub 1.6.0
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d4329b36c0c1dda7dbbcfeb826b045df9d1aadd4d606ac62a70a8f7740c445d5_amd64 as a component of Red Hat multicluster global hub 1.6.0

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.

🔗 References (13)