RHSA-2026:72853HighCVSS 8.1

Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.7 security update

Published
September 28, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (12)

CVE-2026-56862 →CVE-2026-73500 →CVE-2026-84445 →CVE-2026-39820 →CVE-2026-41178 →CVE-2026-46600 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-25681 →CVE-2026-33818 →CVE-2026-56852 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-73500 — etcd: etcd: Denial of Service via unbounded TLS handshake goroutines CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products125

  • multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:02fbc4a8a9ae8357ea82b2904f2f931e6891e8c3c0987225669319e5f4da71d7_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:20cd7ea4dc9d96ba6f4002b75d798ec4f8aa511e4075d8c29232fc721d845f3d_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7d49ac86ecc9efd459fa2ff9f325c9ab1c3074d6c468874e8b09f8da9bc16eb1_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8493d8555dcd13e24e49ac286b6fd5e085709f0c53aa1de01e7c108dcd481aee_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:0e9be983d4318b40566a2f0804210168e138d0886a468b1f86f4267c1b0d2650_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:7b258a894541713b5d1f30f685824b61a1999c8bd7c7ee05c50a5eaff7e7fbb1_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:8de6b3346c7d880078336b661a98ac3435783554ce40d4adfea27b3c9d57c6dc_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:ea18d71639018f1896c2c5db12f571a2d13665f2cc0da1a74c7d7bd18dbd29d8_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:032f690cd3c4b4a6b58de819fcea454bbca7bcb8d192bc84c79dc9ba482bc089_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:0f278e40811cc934a69303003267b210bcedd8f98b359d9c6eb8418f4113f7ee_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:810ef840aec8b6b367d021f4d75174e9f68a43dc5eb74d643ec2136d518c11bf_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:9529962b72a2968da0181a212d6d27e4e2fc2147a17a16e2aa87654023fc4757_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:811ccf7555a76e1ffd22bda0ae4be3fc94b3c8404488f05f02670abcb9236089_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:9f4b3ddb1f9b7c3902582a8b528c9d16e5b315204289f15253d8ec03fd47d291_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:adc24693708a552f5cc55da297b1a28c0b513f70cabf07b0975ee7c84c0fd642_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:f7ca934f1f9d78a592fb704c8674dc4b8a823762daff7e461521946338d55c74_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:49bd64e91978ed936ae78f74d07ecd84c4778dcd6b9bf587081a3364e06b3bf0_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:795b1900627686b437fbf9d5153b14ec6920815b417ec7dce03d98b957dd5ad7_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:96677d0ef6f831892af3f76f48f6483c9b9602384ee896421521d1441957a680_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:bde5dea7a39279fd95de943a431991d8a6b64e12ee396a0e3e601266a3bcd441_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:243b81ab33c4e7d85d854095dd4ffb1749a47b048cab0d6fa4c782caa3dd7232_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:340557724ccc6b2579d38cc5ac9cd4636f2c5b5fd35d5916e63464176af47e94_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:8b24e2f95c0283a4f7fb1bf1aaa121c732efef14d4d7bb66caff807aeaf55f4b_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:c92a7fc4f71ffb46afc14b2776880db3e86e0622e6ea3bd03b725324eda083bd_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:4e7e6e77f0c097ecdf2b6816cf669d70b6f4bbb4db4458e9c42cd25cb74efd2f_amd64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6edfffb5a837b19518c07469bdb0918b0b8040eafce306ea665a6d33948b5033_arm64 as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:ad1d562d275cbf1d98efc9e43b3b4c51b3c456367ebc3efc9e7f5b9366b1300a_ppc64le as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:b0582bd31d8be15286353d4f43b83461b9165c29e9b19d0b1befee3499dbf3a2_s390x as a component of multicluster engine for Kubernetes 2.10
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:337df72d74f62b27c0bd7c31248b8469dee4bb901c2af03bb7fa8a632d09e2a3_arm64 as a component of multicluster engine for Kubernetes 2.10
  • +95 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Restrict network access to the etcd TLS listener to only trusted clients and networks. Configure firewall rules to limit inbound connections to the etcd client port (default 2379) and peer port (default 2380) to authorized hosts. This reduces the attack surface by preventing untrusted network attackers from reaching the vulnerable service.

🔗 References (15)