RHSA-2026:95517HighCVSS 9.1

Red Hat Security Advisory: Multicluster Global Hub 1.7.4 security update

Published
November 5, 2026
Last Modified
November 7, 2026

🔗 CVE IDs covered (16)

CVE-2026-92543 →CVE-2026-14199 →CVE-2026-84445 →CVE-2026-15815 →CVE-2026-17183 →CVE-2026-39834 →CVE-2026-63209 →CVE-2026-73501 →CVE-2026-92542 →CVE-2026-42127 →CVE-2026-77354 →CVE-2026-77411 →CVE-2026-88031 →CVE-2026-73502 →CVE-2026-76905 →CVE-2026-77405 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-17183 — grafana: Grafana: Information disclosure vulnerability in Unified Alerting CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-42127 — grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-73501 — github.com/getkin/kin-openapi: kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default CVE-2026-73502 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference CVE-2026-76905 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via malformed multipart/form-data body CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding CVE-2026-77405 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77411 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-92542 — github.com/moby/moby: Moby: Unauthorized traffic injection via forged VXLAN datagrams CVE-2026-92543 — github.com/moby/moby: Docker Engine: Certificate verification bypass via flawed registry DNS check

🎯 Affected products22

  • Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8d9fe00b9c80796cc710c0b49e06795ecf55c6197816e228ef4e446a21379099_s390x as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:dd4c512a9c5380427626a0551acc640ff9f96ab07425fb651596a46170b327cb_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:e2afb30aa162a59f0e4103028bf05569997975f87145f5bbb8d006e1ac35c8b5_ppc64le as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:fe98904a78d0381f3c2ef32c753ae162877407e6009ca17809fb3277f7abc7ef_arm64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2985d0c15c423aa3f9f5df66c20b5ece4bd37f2e3eb952aaf1d9745bb456b527_s390x as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:43f52c460629cca07989cc716cfa465eb858ef3705701da139a55ac5017eabab_ppc64le as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7415295d72e74543d00c2023f1c5624d5f15b0ffa2bd42c017badf02d78c47f8_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f6a443ce52764b13427f63ffa4f25e051000602945d3af47c75639c9b4bf0656_arm64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:3b97cbea44da8cad3199d15f0c96f2f3440163bd0d5086fa00db86ea258e911d_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:42a831b19cb8c62e92a02d0824d7c70962c1a1051e5a9028632c7454ec42c1fe_arm64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4e13279115416885d5d42088caccd1601915f65f214c2c5f4c811e9682c231ae_s390x as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:5fd8b7c211113e96d99371c527110103bf388bac27b0c864ee9d8bfd2d8d1cd9_ppc64le as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f0b3920c39b77eee70260673aeb0df7c86ef1f5ef1bd8f0746998574ef5260e6_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3a861e08ae9444fe8bdf68a9be271f6b0bac4d335634f12e9b7f14a96ac0d4e8_ppc64le as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:418a309a403ff81d1f060365162dcbd1b570fdfa4154b3202332a1235e2196b3_arm64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:54c611edba4887450fc738ac7aba75662388be94714b3465bd6090ae11b241bb_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7d725d3b1e221831ace1de469533d1bedee8734794faa93fc5897c65bc3dfd64_s390x as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3175d4a76291ffc120e2104b334d1c317acc6b457b95b91927fd421d305f7e99_amd64 as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3315f7920e9dee76f5793574838bd41f05a84ce4df6e835f738633581bd004d6_s390x as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cac2709900dbce683afd61b64780fa49451efc15a3ed56dfafba4062f07c9174_ppc64le as a component of Multicluster Global Hub 1.7.4
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d428512a746ffc8ab230d06368396dc1bbd95dd440104001cad31890a1106111_arm64 as a component of Multicluster Global Hub 1.7.4

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability. Workaround: Restrict alert rule creation and editing permissions to trusted administrators using Grafana RBAC, or enforce strict read-only and least-privilege credential scopes directly on backend datasources. Workaround: Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached. Workaround: Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly. Workaround: Connect applications only to trusted AMQP brokers, restrict network access to approved broker endpoints, use transport security and protected credentials, and update to a Red Hat product version containing the fix for amqp091-go 1.13.0 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.).

🔗 References (19)