RHSA-2026:96629HighCVSS 8.8

Red Hat Security Advisory: Red Hat multicluster engine for Kubernetes - 2.17.4

Published
November 9, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (25)

CVE-2026-56858 →CVE-2026-93748 →CVE-2026-106446 →CVE-2026-39822 →CVE-2026-56859 →CVE-2026-56865 →CVE-2026-63209 →CVE-2026-84445 →CVE-2026-25681 →CVE-2026-27136 →CVE-2026-39834 →CVE-2026-42502 →CVE-2026-56862 →CVE-2026-84394 →CVE-2026-88031 →CVE-2026-106445 →CVE-2026-33818 →CVE-2026-41178 →CVE-2026-56853 →CVE-2026-56860 →CVE-2026-56864 →CVE-2026-84292 →CVE-2026-84304 →CVE-2026-84375 →CVE-2026-39821 →

📋 Description

CVE-2026-25681 — golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-56864 — golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB CVE-2026-56865 — golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84394 — fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

🎯 Affected products86

  • multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:514238b3d00d832c7b154d88700df02b3b69da1186c9565d3f294a3b1122136a_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:58e46ecf7c755af6646848c25d38f30812e639c7bd3b6e1d4dace9454c73bf4b_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5c8d99ed82e6c1f8c0001f742980ce0423980ff98f7fa84d0dbf49377cf5d4fb_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:8dc749aa71da35422f18240fdada9b2c3e05c87e697e41e7c4a7722d0a34f6bd_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:1514ae4f7061bf84df707afe8e250c0cfc3bede3fda73e759976372b962b524f_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:3e0b680cc36aa8e15c68e33a10bfc26c31d424f0655bf8ff3f0be46503cb363c_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:48c0ebefd09b5c21734b504fadc3c92889d70782c443fe1f0717b30d77f9255b_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:8f3b3e12e3613811fc46b5a305f204d2f84bd9ec43d2014bc9ac32c6d544a09c_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:03196712d54ac5905f2ff2a121179fda6208d688e61cad314bfdb8bd85c73394_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:3404e415141f46232de8888b63e3e8d0115b664a41f091aa8a0e12f5dfbf4578_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:6b02eaa95b24b29704a53347e5b7fb7edb260b39f8ba9b06442963bbfa7fcdcf_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:d0314ab48402eeea0cd78df56596763e6415c4739fa36c4399e2505bfa4c0cd3_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:1616df38b8713b9625abacd85956d8e2ba740d30a216a0c21dd6338d16850105_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:1f496c50bcd0b178c70d6517af768aea83f79ff1b7eb5c565495eee884f4b1ff_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:5b11da4b24eb04236bd8050398ccae1ef2de703ee20b25e6dac2e81ca0d20e90_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:833636cbac96502e7351d7a6bf2b4d2f8b28f762a16fe75ca9fa4c5aa2521eac_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:299fd714c8499ae0ebe52edb9522686a80ec3087c4404ec6f5ceb81bd8acf70c_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:b4c58ebce847ee6f5b3afd9c14ee8ed475f4e9eecb8603d857dd7904b066fecd_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:c2d91e446d119e872175acb7a2d04ebfa3ea927936398464ada0472a2aadfbe6_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:ce5416813ff6279b25b4504de1157eadd91a08ad51f3ba23f4245a4ba81aff2f_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:48d9a275d26c95a04ae6529a5cd0c4f2fb283465e548fd0c608e5babd0c70038_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:569f666d6a57a1820c8f063cfbd3adf792503a0a0a14f0035d9cd759aa80d7d0_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:6f38ad39d26b4de32ab3ca35f1c23ed9bc5d6fe14ebfe5a6464a7d6cf911d869_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-azure-rhel9@sha256:881123ab3d66b70344e73c69689a9e72d197710ca19ce761507a006ad32e7351_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:2a19e692add872c15b7fb36fda922cbfca383bdd60f63ad8cdb11acbf8710ff4_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:59ab69faff9b9f3387571122960964783e3f96756b4c35657deab856f481e726_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:a251c86fcd2fcc76d50ab64af2c0ab2c42d482b32c2a9a806e9be948f8f041d5_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:ffd8f34e2adecf357d15008fb461cdfa0eb10040e2495252074d4f531d1a66c5_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:3b9b7f5795148df7eeca1dffc492fe236015ff60ab392ed15f7a95cfec83bcf6_s390x as a component of multicluster engine for Kubernetes 2.17
  • +56 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/latest/html/clusters/cluster_mce_overview#mce-install-intro Workaround: To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input. Workaround: No mitigation is available for this vulnerability. Update the affected packages to golang.org/x/mod version 0.40.0 or later, or Go toolchain version 1.25.13, 1.26.6, or 1.27.0-rc.3 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.

🔗 References (28)