RHSA-2026:72892HighCVSS 7.5

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update

Published
September 28, 2026
Last Modified
October 5, 2026

🔗 CVE IDs covered (6)

CVE-2026-46600 →CVE-2026-56852 →CVE-2026-84445 →CVE-2026-41178 →CVE-2026-42151 →CVE-2026-42502 →

📋 Description

CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products189

  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:b76a53ac18143d6d5edcb821246c2ffdcd553f324e472c5e90c3c00aa199f39e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:c243a50f51660eb38d613201fbb38b2f36a022bb655ac10a13f61021bfe77858_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:f90071f914ef53544da770497b75cb421e663285b39ce38999214be133e382fc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:fe219daeeb0b53896708a5d0fd7baf6efcc3cc5aec5b2088fc28e00065f9752c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:42f207625ea932401b7a5d7cb82ef19f536f6da2903d40b1bcc2916a1cfd6f0c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:6dca59bf3fbeb157ef944dd511f7eb98b9c17cef20c11a8f1d820c21e814769f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:cc017622fc4bc93b940801a153ceeaa2ff4ddb46038417d7eed6cd9420baeded_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:d700ba369ca14ca3062ca5840192d2297c259156b6a8d15807e7be5f6663516c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:4cb9c9b63322dc48b6a4f2daf924f3973f143eba816d96e2a17bfe6373c4539f_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:6389536c9b26eb2130c1cd14b0fa7a519c19e847da933aa62bdcb07c6ded80c6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:b2686e2b09ecde5085e3490dadfbd18051725004f93340b2e1db38a0b41a7881_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:b5319ebc369955693d3e03a7cb73abc37307d1577131b5b0d7df23568a2ead71_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:1b0f1b65a1a7209f3d49a05e53351273a8d9feacca69ad8c79c931816088b8ec_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:525cc158a42bc26afaab4742c6502c56da665806c5229ef2b1887cb232355b34_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:8d1dd8803567022510c7df2523d943de664c47f0781a1cb613c8bba07b68dd7d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:ac4d7bc2f84174bee2fec956cc6dd490720d36f8d80b957633b75d71ea6ea3ed_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:233146e9159287a7ead9f6c7dad0b499cfbc2814fcb25a2ce8f0bc01f4eb9991_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:9e25162240d0f8c7dd17be5cacc002f5143de73f5be2d19557f3fc2b0c524f32_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:ca6e8cb76d0f385d101d5b223a5639b2601f6cbed483805546d292ae56b2303c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:eaf675fe18e489077143f3756732e3e572c8153d25ce50fe2dbfc7efaf55aa19_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:2300b5a20a7d36e83a36641ef88b49d7fd4f67a571fba6abe8839e01747426c0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:80e675d49137d3b74718ed291dc638fb1a86961117204871105552586e2a2e41_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ab15c4ad2de1c26273137e8eafbc4412aad761ed973098f2f5efd9f11389d969_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:d49c31204acea193a6290c881148564eba018792af59273d873c89324985e0a6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:7c3038cfc6c71aaa192a7eaa720bf27a6c8cbf001979ab48af311496f959c311_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:eec5278ad8a8a1a76d13f708774d4efbec586b0291fdb060f70afc0b94771c0e_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:f87d650cc32a500927f585e86fb90d2eae515f201844d2ed7bbf3b6c544a07be_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:fd0215f6c58c91bafc6c64e22988f91962086d892d02a91a54adb8f34d932767_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:20d884607133b8bd6df7843dcf65b7ea3262946fdc574b0f19c397a1eed03cd8_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • +159 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (10)