RHSA-2026:92307HighCVSS 8.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update

Published
October 29, 2026
Last Modified
October 31, 2026

🔗 CVE IDs covered (22)

CVE-2026-84304 →CVE-2026-14199 →CVE-2026-15815 →CVE-2026-37236 →CVE-2026-77411 →CVE-2026-88031 →CVE-2026-93748 →CVE-2026-39834 →CVE-2026-56862 →CVE-2026-63209 →CVE-2026-77405 →CVE-2026-84375 →CVE-2026-33818 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-77354 →CVE-2026-84445 →CVE-2026-106445 →CVE-2026-106446 →CVE-2026-56854 →CVE-2026-56858 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-37236 — github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding CVE-2026-77405 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77411 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

🎯 Affected products177

  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:2b421e8287ec9000a543d5cff7fa4f11aadb8232292f7621ecd24cd393a31fad_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:3ff11f56dba1623295a51d41f4221f964a3485070ad331939e3920eb82df8123_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:55b387bf28bd72839f09ff5e78f851e706ca05994fd015d6c315379e8c079a12_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:9fbf73cdaf86c540fa18e84d1428ec8cfa2737d74bec906c1a6dc29835658336_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:1a4b6b32860915bf7e226d7ce4751ce735b9fcecd7eb5ddfc9e2ea73ab6d809f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:2840387b90e57f3f7f8d42e85aa7282dcef053a93e09a684c18f58da77c7d3a6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:2d27443b68eef974d561e6206800357ba7819a13bf7ec1c50042f23454867987_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:7003aac64bca5a1414171e265abfae0e1652249defef22d75e937ff15579f9fc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:50c8d3eac9fd00f481636278081c401f0ab8f52994b9c2ca8ee5be29a1999390_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:8b70ff3d7ac46c47501c1245c418f3abf34a74b3bfd5cbb92133c935cd989d28_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:f01f1a550108cea2d16d29372013fb8dd77d657cef8f4614c2adb575116b5cb5_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:f8f5ba7ba8eaebec398d30a9a94c2ee20cf0dbf8683a86d19704295eeb546818_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:0b9c6da4b67154778293db9672a7398f5ef4a4cf673059372057c07adf623203_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:4bb0f210c5f3c088937ba4a765a5f1446cf4438343f7a7563c144d64cce6ddff_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:68124a3180da90cd8f1425be6a06dd398eabb01bdf945d517dd85feb900a6dc7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:6aefa68b2441601bb315d34becc42c47451784f4d4bef00c101cdfb5da29a5cf_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:02f2a88135b9a1b375538a5baf70ae485db38a2cf69157811f1e445d74418b36_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:94be1fa638b24553f8a22d5d58421a53b727dd235cfe23b3f3ef36db921ce364_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:c7737177c846ae70419807c0d3739823a6c335548c78ce123e43f118d7932433_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:f29abe6cea375f6991b6df9da606514f16734beaffcd15c0c8a9122c937ba53c_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:1ecd08ac5bfc80cb9cc535cdc6c0032416047526b6c7b64e4867149c3cd90594_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:99dc5e84975e29b80294c0182f2e4799a8228f71766b798bcb8bacbf41d6fad4_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:c6e8959e23b07861b48026939024e6d84f177b6b33adfbdcd4cf2596328de844_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:f08dd05e84b2299da016e5d88227b582d19fa337459c8a72bf58d94943c038a0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:062c37cbefb0de629c9d6045b2269ef6574ebf591941b76f6e4ce8008e91eae8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:5b1477863e3bffc0b6f5aee4dd20708b8e9d7cb0bc619657fdcd8fd2d514239e_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:e3e79c136cbd3a575ee70098dd9ddd728efa3fa1e7e9645fd135da48f767a057_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:f6747ced5b77cbcf14ca98a1a77dc370b44aa66c305fb5aefae32219a516c8dc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:19e8d19d48d533acdc189a7403191dd1ededdd2455985fa3cccd57050840e58b_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.13
  • +147 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the `X-HTTP-Method-Override` header from incoming requests before they are forwarded to `grpc-gateway` applications. This prevents the `grpc-gateway` from processing the malicious header and bypassing access controls. Workaround: Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly. Workaround: Connect applications only to trusted AMQP brokers, restrict network access to approved broker endpoints, use transport security and protected credentials, and update to a Red Hat product version containing the fix for amqp091-go 1.13.0 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.

🔗 References (26)