RHSA-2026:99956HighCVSS 8.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.7 security update

Published
November 12, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (31)

CVE-2026-50163 →CVE-2026-84292 →CVE-2026-84375 →CVE-2026-33818 →CVE-2026-56858 →CVE-2026-56860 →CVE-2026-37236 →CVE-2026-42127 →CVE-2026-88031 →CVE-2026-106446 →CVE-2026-45570 →CVE-2026-56862 →CVE-2026-77405 →CVE-2026-93748 →CVE-2026-116591 →CVE-2026-14199 →CVE-2026-15815 →CVE-2026-39834 →CVE-2026-56854 →CVE-2026-56859 →CVE-2026-73502 →CVE-2026-77354 →CVE-2026-84304 →CVE-2026-84445 →CVE-2026-84394 →CVE-2026-56853 →CVE-2026-63209 →CVE-2026-77411 →CVE-2026-106445 →CVE-2026-41178 →CVE-2026-50162 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-37236 — github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42127 — grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-45570 — github.com/go-git/go-git: go-git: Shell command injection in SSH transport CVE-2026-50162 — oras-go: oras-go: File store write outside working directory via symlink traversal CVE-2026-50163 — oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-73502 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding CVE-2026-77405 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77411 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84394 — fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products189

  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:707f1170efa4ef4ac6b29c7249575d7554b36997744d414e17661ba9c25c79a4_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:94b3d92383cf13efe147d84eb4c5f34263539374ee28bfef21a9adce148e8ebd_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:c40f19652e95a16c3cd919a1aec15b908cdc05d32c2f4bad3bbb6354078081da_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:fbd1db80798d8ec75df9e34903e426017b9bebc4a265fb53e69bbf88bcdf61fb_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:3350d3c3867138dc1667b2320e79e1bde3ca69c310cc5e8546cc7d345709cad4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:7d28a3e3ef7df56fbafaa180d5ac8430da3c2e7e09fc39a8a41ec64c7554ad5e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:c63dc7ee5a4db18e84311e9614cb5cfb8247a72065470b1c23210a65ffbdea83_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:e7bdce85bcda43ef54f959b34ae8bf58b100cead8d1ceac8eaacf32beac8efb2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:7cb4c38101425e91853e295c6b6b9f475a4f0ec5d456e33c48bb4f6d34723d0c_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:d75c81555347b08899fa707532020bb930a27d4b808aff5bb1eb86c8ba280882_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:ed3cc49f9b8aed3f4aa57060968dd441c7ac412dcd3be61f93fd5df84f711caa_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:f83cdc251164038fc42c2716443a78e49d77ccf6d40fa9500229d5570303fbfa_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:68295c5ddf451f1fec428536cc599540405150d26277861000fd506fc02863a6_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:899eccc73f6d538ce5aa222d86cb1131a763260c985a63641fcf3137629e71a1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:ac4d2332323e5b9a8474e9631fe77d99a45f5be7dc3a1ef109a4528394d5f5b6_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:fb92999464c064cc7b9476a35c2ee4ec0a79d2dd2c032eecaf677a7fb7a39ba0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:375df9d173be15f676f86ea3c97b73493f261178928295e4d7eda0c1a6f57c30_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:7ef31ea827026ad41810a29436163f6097b058688e5ea98bdbf48d7a3a0213fc_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:9ca7206a3bb5e1ab3dec302925ffa614419883ee35844ad157828e0e67f0e808_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:a9e64cdcbff666cc76ce0b7ee18fc794ae39acb20ad9626a1327513064d3a8c1_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:07ec5cf5b92af8d8831feacab5d810a44fad38b17380a3d447bfca7c54194178_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:5a262eadc93c656f24def2f45519aa69f2dd3abfdfa8bb0b69dcf8fe3107d418_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:dfc73e5fd5d9e1fbe9f42e4a23244c1fbc5ba1534ff25087a5a534e613c620a7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:fc04d4905dd00092e92ef11f5b80f11499a4df332ef839db674d4cf3a6e42d2f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:03b21fbe7a3539a1806f84721b690f835fd36719bb07a67fa9a7ce66fca27e98_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:57e8171b4bee3b8505972558ff5a215a65d394830c313d66ef2742d361f1dbd6_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:9b490f30abf5c7d2b5ea543f5c117e7a0bb8db3f0f3d0245bd5236e3974f5d41_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:e673e3ce4743bde57766266bcbae02f47d810f8a9b549e44247fe2b49d460bcc_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:383c5fd6f1cac7e7282c339e53b2ebd1f70812109da068ca7923325c0a69d4f8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16
  • +159 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the `X-HTTP-Method-Override` header from incoming requests before they are forwarded to `grpc-gateway` applications. This prevents the `grpc-gateway` from processing the malicious header and bypassing access controls. Workaround: Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect. Workaround: Upgrade to oras-go v2.6.1 or later. Workaround: As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached. Workaround: Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly. Workaround: Connect applications only to trusted AMQP brokers, restrict network access to approved broker endpoints, use transport security and protected credentials, and update to a Red Hat product version containing the fix for amqp091-go 1.13.0 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (35)