RHSA-2026:85846HighCVSS 9.1

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.18 security and bug fix update

Published
October 20, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (9)

CVE-2026-33186 →CVE-2026-69153 →CVE-2026-87776 →CVE-2026-88031 →CVE-2026-93749 →CVE-2026-59879 →CVE-2026-84445 →CVE-2026-90711 →CVE-2026-92599 →

📋 Description

CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-59879 — immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations CVE-2026-69153 — postcss: PostCSS: Information disclosure via crafted sourceMappingURL CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-87776 — compression: compression: Denial of Service via memory leak on premature response close CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-90711 — proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-92599 — joi: joi: Denial of Service via isoDate validation regular expression CVE-2026-93749 — source-map-js: source-map-js: Denial of Service via malformed indexed source maps

🎯 Affected products12

  • Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 as a component of Red Hat Migration Toolkit 1.8
  • registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 as a component of Red Hat Migration Toolkit 1.8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications should implement input validation to reject or clamp any externally supplied List index or key-path segment that exceeds a sane maximum, specifically values greater than or equal to 2^30. Additionally, running request handling in isolated worker processes with capped heap sizes (e.g., using `--max-old-space-size`) can contain the impact of a potential process abort. Workaround: Pass map: false when invoking PostCSS to disable source map auto-loading. This prevents the path traversal from being triggered, though it removes source map support entirely. Workaround: Update the compression middleware to version 1.8.2 or later. No supported workaround is currently available if the affected version cannot be updated. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: To mitigate this flaw through configuration: 1. Configure trusted proxy definitions using standard IPv4 notation (such as `10.0.0.0/8`) rather than IPv4-mapped IPv6 notation. 2. If IPv4-mapped IPv6 notation is required, set the subnet prefix length to at least 97 to cover the mapped boundary (for example, specify `::ffff:10.0.0.0/104` instead of `::ffff:10.0.0.0/8`). 3. Alternatively, sanitize or strip incoming `X-Forwarded-For` headers at edge load balancers or boundary reverse proxies before passing traffic to backend applications. Warning: Modifying application configuration files requires restarting the Node.js application service, which will temporarily interrupt service availability and active connections. Workaround: To mitigate this vulnerability, ensure that any input strings processed by the `Joi.string().isoDate()` validation rule are capped in length before being passed to the 'joi' package. This can prevent the regular expression engine from consuming excessive resources and causing a denial of service.

🔗 References (13)