RHSA-2026:8218HighCVSS 8.8

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.5 security update

Published
April 15, 2026
Last Modified
August 31, 2026

🔗 CVE IDs covered (10)

CVE-2025-13465 →CVE-2025-47907 →CVE-2025-58183 →CVE-2026-29063 →CVE-2025-61726 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-4740 →CVE-2026-22029 →CVE-2026-25639 →

📋 Description

CVE-2025-13465 — lodash: prototype pollution in _.unset and _.omit functions CVE-2025-47907 — database/sql: Postgres Scan Race Condition CVE-2025-58183 — golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-4740 — rhacm: Open Cluster Management (OCM): Cross-cluster privilege escalation via improper Kubernetes client certificate renewal validation CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution

🎯 Affected products109

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8726da36d26d647248ec7d0a38c37760a86b909d5e32535cd79573ba73418e65_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:b0c5ea5c0c5cb1ffb39a18da2d69714adeab262037769c8bb61a08165a9b249d_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e7d9e3b4d184144fe0048620e63f8605ba70ff6ba6b5f91d911facbe2cc43dc9_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f6bf8d199b9346b82197c5911b00d4a7a6cb9b7c84d5b0c3d5052aee07e23f53_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:553edf965192cf55bc245e8a3bbf3a27545d62d03d311acc24062a2554a2e85f_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:5d7b59bfe6851def3f341bfad75ef2e6fcea8cc77ea3268167519f8d3bae5c33_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6abe1731496380fe823109b6acc4415130e65d51722e27da134eb79f0a3f4f18_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:baedd408112b3fbd00b03ff80f5bf1afc390250aa5aa07ed4e83aadc5ea47e4c_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:797e7b8b8dd7e769d8af43c94076e17b0e9dad73121bafd44368b95c0e5b21d2_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:a368438d68a76db54dc21edee2a9dfe0356201730e5edaf3efe2e5d35cf4812b_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:c18392461e4b948a1e269a91750048df39b06512e0c12b35ca2bfcbd7cbfc6bc_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d4e3c622c9e9e9fd7715efe0675082b313811c3ad4be4d483b0bd6df4137b98d_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:384d7665ebd94ba2c06dc5039f63b2e5d9a7562c2c55dc5018a4605cb72f8159_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:6efea98320dbf13ef6b7bd24cc45b5cddc2f9368b71556770abd846f27b0b989_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98fade294c1ff0688c36878f62275e82a2b19696c2a01edd5fa78acca4a99104_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:e26c917cc85445632f6e971636a98d5e7a0bbc3c1fd3dc647385c3ab4abf13f0_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:5e4dde4a4e91f67ad09ea3fe2b685731570fbbdab3bed1729f727ed50728f0aa_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:89623857fddc1cb6a4c00f7927adeebe64a9035b104bee39c7c4e5ca73d4161a_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:928850a95a992b3cad76163aa68c17971cd1c4d2eb4cc2aa7495fa43a03c7f9c_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ad1094291b455efbcb67c99059f25aa0c324a8ea57f1b4917995ca8daefe602d_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:1903cc91969e1e9a9d90676abbaf6a13af2644ab4678c4354cc4c436c7d73320_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6eaae5bbd36db4137748ce56b9bdb89440d46cf33e44deb7886742151a926233_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:ad396a22c7dfc18d3755b5226322b02cf53e9d889d8c4c0fd9f3fc18640d5229_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f4e156751bf139839b078a9ed28ac273209573d752850d2191cf523168ecef3c_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:3aa5791c30722dc9a41b11af0e6165b16e1fbb90f9223402f15ccd1b3ab87bcb_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:61aca1200e3f76ad5608ec2fea60192281cfd8dc883ca95a952d4634b362b28d_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:74d46cd69f0ea430d4f64bb7eb2c7801552fd75180bd174afba4280202487a9b_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d69c9156ba667438e59cb8c71a905fd92a26e830629a5c20223d70173a64a95b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:79bbb4f57c6b596c4926a8bc3a8fb9f885f05251a6c93a903622ea18ed77f224_s390x as a component of multicluster engine for Kubernetes 2.8
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this issue, implement strict input validation before passing any property paths to the _.unset and _.omit functions to block attempts to access the prototype chain. Ensure that strings like __proto__, constructor and prototype are blocked, for example. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (13)