RHSA-2026:99963HighCVSS 8.8

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.7 security update

Published
November 13, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (28)

CVE-2026-56860 →CVE-2026-56862 →CVE-2026-77411 →CVE-2026-15815 →CVE-2026-33818 →CVE-2026-39834 →CVE-2026-50163 →CVE-2026-63209 →CVE-2026-73502 →CVE-2026-77354 →CVE-2026-84375 →CVE-2026-37236 →CVE-2026-42127 →CVE-2026-106446 →CVE-2026-116591 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-77405 →CVE-2026-84304 →CVE-2026-84445 →CVE-2026-88031 →CVE-2026-93748 →CVE-2026-106445 →CVE-2026-14199 →CVE-2026-45570 →CVE-2026-50162 →CVE-2026-56854 →CVE-2026-56859 →

📋 Description

CVE-2026-14199 — grafana: Grafana: Session takeover via Auth Proxy cache key collision CVE-2026-15815 — grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-37236 — github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-42127 — grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads CVE-2026-45570 — github.com/go-git/go-git: go-git: Shell command injection in SSH transport CVE-2026-50162 — oras-go: oras-go: File store write outside working directory via symlink traversal CVE-2026-50163 — oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56854 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-73502 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unauthenticated nil-pointer dereference CVE-2026-77354 — github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding CVE-2026-77405 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77411 — github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-88031 — go.mongodb.org/mongo-driver: go.mongodb.org/mongo-driver/v2: MongoDB Go Driver: Data deletion via query-operator injection in GridFS file IDs CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products177

  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:0d43b82dda8a8335464a9ce7e275db7165978f39987ce8f99817cc487114b0ed_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:2de8eb3975bad7ff48f5722f28992ee212060c8700788e4369af6abd75a7f963_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:abdfd9156d357ea129c7dbcb1b589a1a162738c9861a477a9c0101bff3d395ce_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cli-rhel9@sha256:ef7187c6775c4851a7882d70a2eccc3b6b07874c3949ab359f0576169bdbbbcb_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:17789cc4af9a474a42530d63600c8a1623c445badec46a2eab0056802654d558_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:38e6b35ff780ab0009871034cf06335fc92053f67f46721e224ee99eef079074_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:e53c92c8e990eb24822e4a254228b180fe5fe4bca248c1a0385d2dc1deb255b4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:ead0bc297ddac86bc8b6dce8b9a91d4f432559b8cab3d0fd6ee626bd4f6c0d3b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:5bc8d2cb18e4e7e9713dde6373dc3d3d08b998619c96d2e42f7b2057de964cfd_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:99b01135501bc9bfceb2ff05cc6482339fa699240353a1adfeb6f8b53a0e9565_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:c6663fa8f887beac163430fc3c0634f7cc8ba0a0df9c9b5b6ee59cff326ee652_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:f71d9002b0714626737f7d3774b4f0abde6fc0079dec3ff8d7ecce1b94376136_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:4c6177c58134d041e95bc073db30c966e15a360b2f1d57f90e46fa3c1f400848_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:52fa8866a407a43e2d6316739499e5b79a4ac9fb44f1c8a1bc6cd93a23fc66a5_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:8c8221e43ab05cbe0b95f678577af9260930d643b91214335632e65c12c19306_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-governance-policy-framework-addon-rhel9@sha256:cce64b29ae1cece2355485e6e572f86ce099999ba38187a5256dede50b966a98_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:ad365aa670d413f45eb17d4a357e7045589346c52c905fd99d35fc222e4f67e2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:bf881032edf8e0b6e8301b03c8d19821e6d9c5353e1df148c1f28ab3bec0f744_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:c4ce8439082531068f16ea36823b2a8116855b13c8b9d3cb620a40b171d06616_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-grafana-rhel9@sha256:eaaff5cc066cefed0a28d252ef89ded852497bf91a4ff5b8b02bd5221deae3d5_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:3259676cb5758d136795de077cc7a2a5bccd04dec882f3274da6348790cb7e70_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:b7bf3c3f3dfe41cd1b759a04a84cf9d5a1136c6ff2e92927d40dba1eb508c165_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:faaf8b8562b8ffec2cc1b1cf1228052801f1aef3d6a865683055c6a85f545fc0_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:fdfc941bebaa66ac8f4f9f65cf17b3baa222f1b32d9cf59f41670d28ade9a958_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:30b2694b9ef0f7f5b415bee06269294a49d72c3bb9bc040a602ae662e1c7d667_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:59e331217662fbdf7d1536426eef21c195991bbc0078ba0a6e8679490d1a8849_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:67cda445b875ec022f3512aaa9d8689b67ff844e178ef93abc44d5dd82e3e978_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-must-gather-rhel9@sha256:8a36e106a4a1f4565c2b0e8d3f44b2baadb1426b51440a67dacf071d3cded5a2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9@sha256:2ffcb5b3a58165fa4964708c319ae36ba6c72b93d5b9f0402334385b86eadb8c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.14
  • +147 more not shown

✅ Remediation

Before you apply this update, make sure all previously released errata that are relevant to your system are applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Set [auth.proxy] sync_ttl = 0 to disable the identity cache (identity is then synced on every request), or upgrade to a fixed version: 11.0.0+, 12.4.10+ (12.4.x), 13.0.8+ (13.0.x), 13.1.5+ (13.1.x), or 13.2.1+ (13.2.x and newer — 13.2.0 itself is still vulnerable). Workaround: While no configuration fully mitigates this issue, exposure can be reduced by limiting plugin installations to vetted and pinned sets of plugins from trusted sources. Additionally, disable the `plugin_admin_enabled` setting in the Grafana configuration if not required, to prevent non-administrator users from installing plugins. This can be done by setting `plugin_admin_enabled = false` in the `[plugins]` section of the `grafana.ini` configuration file. A restart of the Grafana service may be required for changes to take effect, which could temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the `X-HTTP-Method-Override` header from incoming requests before they are forwarded to `grpc-gateway` applications. This prevents the `grpc-gateway` from processing the malicious header and bypassing access controls. Workaround: Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect. Workaround: Upgrade to oras-go v2.6.1 or later. Workaround: As a partial workaround, administrators can audit their OpenAPI specification files and ensure every content parameter declares an explicit schema for each media type, which prevents the nil-dereference code path from being reached. Workaround: Ensure clients are built with Go 1.18 or later so the TLS client default is at least TLS 1.2. Restrict AMQP clients to trusted brokers and limit broker network exposure. If using DialTLS with a custom tls.Config, set MinVersion to tls.VersionTLS12 or higher explicitly. Workaround: Connect applications only to trusted AMQP brokers, restrict network access to approved broker endpoints, use transport security and protected credentials, and update to a Red Hat product version containing the fix for amqp091-go 1.13.0 or later. Workaround: If upgrading go.mongodb.org/mongo-driver to version 1.17.10 (v1) or 2.9.1 (v2) is not immediately possible, the following steps can reduce exposure: - Validate file identifiers before passing them to GridFS operations. Ensure that file IDs supplied by users or external systems are scalar values (e.g., primitive.ObjectID or string) and reject any structured BSON documents or maps. This prevents query operator injection. - Restrict who can supply GridFS file identifiers. Do not allow unauthenticated or low-privilege users to directly control the file ID parameter in GridFS API calls (Delete, OpenDownloadStream, DownloadToStream, etc.). Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (32)