Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-41567 (GCVE-0-2026-41567)
Vulnerability from cvelistv5 – Published: 2026-06-05 00:35 – Updated: 2026-09-04 12:04
VLAI
EPSS
VEX
Title
Docker: `PUT /containers/{id}/archive` executes container binary on the host
Summary
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
Severity
7.2 (High)
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-05 13:11 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/moby/moby/security/advisories/… | x_refsource_CONFIRM |
| https://access.redhat.com/security/cve/CVE-2026-41567 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2485356 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
| https://access.redhat.com/errata/RHSA-2026:42852 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:51057 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:37387 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:41030 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:44622 | vendor-advisoryx_refsource_REDHAT |
Impacted products
49 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| moby | moby/v2/daemon |
Affected:
< 2.0.0-beta.14
|
guessed | |
| moby | Docker Engine |
Affected:
< 29.5.1
|
guessed | |
| docker | docker/daemon |
Affected:
<= 28.5.2
|
guessed | |
| Red Hat | Multicluster Global Hub 1.5.6 |
Unaffected:
1784562060 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.5::el9 |
||
| Red Hat | OpenShift Developer Tools and Services 1.6.0 |
Unaffected:
1784727697 , < *
(rpm)
cpe:/a:redhat:source_to_image:1.6::el8 |
||
| Red Hat | OpenShift Developer Tools and Services 1.6.0 |
Unaffected:
1784728036 , < *
(rpm)
cpe:/a:redhat:source_to_image:1.6::el8 |
||
| Red Hat | Red Hat multicluster global hub 1.4.2 |
Unaffected:
1784060681 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.4::el9 |
||
| Red Hat | Red Hat multicluster global hub 1.6.0 |
Unaffected:
1784561376 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.6::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932114 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782931768 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932104 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783536000 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783535989 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783536515 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932521 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783018461 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783018421 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932812 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783537001 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932919 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783537586 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782932969 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933015 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933042 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783537392 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933235 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933251 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783537955 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933417 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783537742 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782933602 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1783019377 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782934054 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782934036 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Red Hat Openshift Data Foundation 4.22 |
Unaffected:
1782934284 , < *
(rpm)
cpe:/a:redhat:openshift_data_foundation:4.22::el9 |
||
| Red Hat | Exploit Intelligence |
cpe:/a:redhat:exploit_intelligence:0
|
||
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine
|
||
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed
|
||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 |
cpe:/a:redhat:acm:2
|
||
| Red Hat | Red Hat Ceph Storage 5 |
cpe:/a:redhat:ceph_storage:5
|
||
| Red Hat | Red Hat Ceph Storage 7 |
cpe:/a:redhat:ceph_storage:7
|
||
| Red Hat | Red Hat Ceph Storage 8 |
cpe:/a:redhat:ceph_storage:8
|
||
| Red Hat | Red Hat Ceph Storage 9 |
cpe:/a:redhat:ceph_storage:9
|
||
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
||
| Red Hat | Red Hat OpenShift distributed tracing 3 |
cpe:/a:redhat:openshift_distributed_tracing:3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41567",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-05T13:11:38.173928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-05T13:11:47.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.5::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
"product": "Multicluster Global Hub 1.5.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784562060",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:source_to_image:1.6::el8"
],
"defaultStatus": "affected",
"packageName": "source-to-image/source-to-image-rhel8",
"product": "OpenShift Developer Tools and Services 1.6.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784727697",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:source_to_image:1.6::el8"
],
"defaultStatus": "affected",
"packageName": "source-to-image/source-to-image-rhel9",
"product": "OpenShift Developer Tools and Services 1.6.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784728036",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
"product": "Red Hat multicluster global hub 1.4.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784060681",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.6::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
"product": "Red Hat multicluster global hub 1.6.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784561376",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/cephcsi-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932114",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/cephcsi-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782931768",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/devicefinder-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932104",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/mcg-core-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783536000",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/mcg-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783535989",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-client-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783536515",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-client-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932521",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-metrics-exporter-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783018461",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/ocs-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783018421",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-blackbox-exporter-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932812",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-cli-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783537001",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932919",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783537586",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-cosi-sidecar-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782932969",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-csi-addons-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933015",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-csi-addons-sidecar-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933042",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-drbd-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783537392",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-external-snapshotter-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933235",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933251",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-multicluster-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783537955",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-multicluster-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933417",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-must-gather-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783537742",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782933602",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odr-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783019377",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odr-volsync-plugin-mover-rhel9",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782934054",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/odr-volsync-plugin-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782934036",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "odf4/rook-ceph-rhel9-operator",
"product": "Red Hat Openshift Data Foundation 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782934284",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:exploit_intelligence:0"
],
"defaultStatus": "affected",
"packageName": "exploit-intelligence-tech-preview/agent-client-rhel9",
"product": "Exploit Intelligence",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/assisted-service-8-rhel8",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/assisted-service-9-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "affected",
"packageName": "multicluster-engine/cluster-api-provider-azure-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "unaffected",
"packageName": "rhacm2/acm-grafana-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:5"
],
"defaultStatus": "affected",
"packageName": "rhceph/rhceph-5-dashboard-rhel8",
"product": "Red Hat Ceph Storage 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:7"
],
"defaultStatus": "affected",
"packageName": "rhceph/grafana-rhel9",
"product": "Red Hat Ceph Storage 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:8"
],
"defaultStatus": "affected",
"packageName": "rhceph/grafana-rhel9",
"product": "Red Hat Ceph Storage 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
],
"defaultStatus": "affected",
"packageName": "rhceph/grafana-rhel10",
"product": "Red Hat Ceph Storage 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "buildah",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "containers-common",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "grype",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "opentelemetry-collector",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "opentelemetry-collector-contrib",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "podman",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "skopeo",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "syft",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "trivy",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-agent-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-router-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-metadata-collection-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-registry-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-must-gather-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/rhai-cli-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-agent-installer-api-server-rhel8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-agent-installer-api-server-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-azure-cluster-api-controllers-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-gcp-cluster-api-controllers-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-openstack-cluster-api-controllers-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3"
],
"defaultStatus": "affected",
"packageName": "rhosdt/opentelemetry-collector-rhel9",
"product": "Red Hat OpenShift distributed tracing 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-05T00:35:50.563Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T12:04:45.511Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"name": "RHBZ#2485356",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37387"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42852: Multicluster Global Hub 1.5.6"
},
{
"lang": "en",
"value": "RHSA-2026:51057: OpenShift Developer Tools and Services 1.6.0"
},
{
"lang": "en",
"value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:41030: Red Hat multicluster global hub 1.4.2"
},
{
"lang": "en",
"value": "RHSA-2026:44622: Red Hat multicluster global hub 1.6.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-05T02:00:54.488Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-05T00:35:50.563Z",
"value": "Made public."
}
],
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "moby/v2/daemon",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.0-beta.14"
}
]
},
{
"product": "Docker Engine",
"vendor": "moby",
"versions": [
{
"status": "affected",
"version": "\u003c 29.5.1"
}
]
},
{
"product": "docker/daemon",
"vendor": "docker",
"versions": [
{
"status": "affected",
"version": "\u003c= 28.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-05T00:35:50.563Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r"
}
],
"source": {
"advisory": "GHSA-x86f-5xw2-fm2r",
"discovery": "UNKNOWN"
},
"title": "Docker: `PUT /containers/{id}/archive` executes container binary on the host"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-41567",
"datePublished": "2026-06-05T00:35:50.563Z",
"dateReserved": "2026-04-21T14:15:21.957Z",
"dateUpdated": "2026-09-04T12:04:45.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-41567",
"date": "2026-09-06",
"epss": "0.00161",
"percentile": "0.05599"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-41567\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-05T02:17:13.817\",\"lastModified\":\"2026-09-04T13:19:41.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images\"},{\"lang\":\"es\",\"value\":\"Moby es un framework de contenedor de c\u00f3digo abierto. En versiones anteriores a la 29.5.1 y en moby/moby v2 anteriores a la v2.0.0-beta.14, cuando un archivo comprimido se sube a un contenedor a trav\u00e9s de \u0027PUT /containers/{id}/archive\u0027 o se canaliza a trav\u00e9s de \u0027docker cp -\u0027, el demonio resuelve los binarios de descompresi\u00f3n (como \u0027xz\u0027 o \u0027unpigz\u0027) desde el sistema de archivos del contenedor en lugar del del host debido a un orden incorrecto de las operaciones. Una imagen de contenedor maliciosa que contenga un binario de descompresi\u00f3n troyanizado puede lograr ejecuci\u00f3n de c\u00f3digo arbitrario con privilegios completos de demonio, incluyendo UID de root del host y capacidades sin restricciones, cuando un usuario sube un archivo comprimido (xz o gzip) a ese contenedor. Este problema est\u00e1 solucionado en Docker Engine 29.5.1 y moby/moby v2.0.0-beta.14. Las soluciones incluyen ejecutar contenedores solo desde im\u00e1genes de confianza, usar plugins de autorizaci\u00f3n para restringir el acceso al endpoint \u0027PUT /containers/{id}/archive\u0027, y evitar canalizar archivos comprimidos a contenedores creados a partir de im\u00e1genes no confiables.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"moby\",\"product\":\"moby/v2/daemon\",\"versions\":[{\"version\":\"\u003c 2.0.0-beta.14\",\"status\":\"affected\"}]},{\"vendor\":\"moby\",\"product\":\"Docker Engine\",\"versions\":[{\"version\":\"\u003c 29.5.1\",\"status\":\"affected\"}]},{\"vendor\":\"docker\",\"product\":\"docker/daemon\",\"versions\":[{\"version\":\"\u003c= 28.5.2\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.5.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"],\"versions\":[{\"version\":\"1784562060\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 1.6.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"source-to-image/source-to-image-rhel8\",\"cpes\":[\"cpe:/a:redhat:source_to_image:1.6::el8\"],\"versions\":[{\"version\":\"1784727697\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services 1.6.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"source-to-image/source-to-image-rhel9\",\"cpes\":[\"cpe:/a:redhat:source_to_image:1.6::el8\"],\"versions\":[{\"version\":\"1784728036\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat multicluster global hub 1.4.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"],\"versions\":[{\"version\":\"1784060681\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat multicluster global hub 1.6.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"],\"versions\":[{\"version\":\"1784561376\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/cephcsi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932114\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/cephcsi-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782931768\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/devicefinder-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932104\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/mcg-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783536000\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/mcg-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783535989\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/ocs-client-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783536515\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/ocs-client-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932521\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/ocs-metrics-exporter-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783018461\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/ocs-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783018421\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-blackbox-exporter-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932812\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783537001\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-cloudnative-pg-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932919\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783537586\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-cosi-sidecar-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782932969\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-csi-addons-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933015\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-csi-addons-sidecar-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933042\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-drbd-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783537392\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-external-snapshotter-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933235\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-external-snapshotter-sidecar-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933251\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-multicluster-console-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783537955\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-multicluster-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933417\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-must-gather-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783537742\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odf-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782933602\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odr-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1783019377\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odr-volsync-plugin-mover-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782934054\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/odr-volsync-plugin-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782934036\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4.22\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"odf4/rook-ceph-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"],\"versions\":[{\"version\":\"1782934284\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Exploit Intelligence\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"exploit-intelligence-tech-preview/agent-client-rhel9\",\"cpes\":[\"cpe:/a:redhat:exploit_intelligence:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/assisted-service-8-rhel8\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/assisted-service-9-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/cluster-api-provider-azure-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhacm2/acm-grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/rhceph-5-dashboard-rhel8\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/grafana-rhel9\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ceph Storage 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhceph/grafana-rhel10\",\"cpes\":[\"cpe:/a:redhat:ceph_storage:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"containers-common\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grype\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector-contrib\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"syft\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trivy\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-llmisvc-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-router-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mod-arch-model-registry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-metadata-collection-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-model-registry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-must-gather-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-rocm64-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-training-cuda128-torch29-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/rhai-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-agent-installer-api-server-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-agent-installer-api-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-azure-cluster-api-controllers-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-gcp-cluster-api-controllers-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-openstack-cluster-api-controllers-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosdt/opentelemetry-collector-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.8,\"impactScore\":5.8},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-05T13:11:38.173928Z\",\"id\":\"CVE-2026-41567\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-427\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-427\"}]}],\"references\":[{\"url\":\"https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37387\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41030\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42852\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:44622\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:51057\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-41567\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2485356\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-06T01:40:02+00:00",
"cve": "CVE-2026-41567",
"id": "CVE-2026-41567",
"initial_release_date": "2026-06-05T00:35:50.563000+00:00",
"product_status:fixed": "128",
"product_status:known_affected": "53",
"product_status:known_not_affected": "81",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.5.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784562060\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:source_to_image:1.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 1.6.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784727697\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"source-to-image/source-to-image-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:source_to_image:1.6::el8\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services 1.6.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784728036\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"source-to-image/source-to-image-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat multicluster global hub 1.4.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784060681\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat multicluster global hub 1.6.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784561376\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-grafana-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932114\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/cephcsi-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782931768\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/cephcsi-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932104\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/devicefinder-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783536000\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/mcg-core-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783535989\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/mcg-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783536515\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/ocs-client-console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932521\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/ocs-client-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783018461\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/ocs-metrics-exporter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783018421\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/ocs-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932812\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-blackbox-exporter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783537001\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-cli-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932919\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-cloudnative-pg-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783537586\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782932969\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-cosi-sidecar-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933015\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-csi-addons-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933042\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-csi-addons-sidecar-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783537392\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-drbd-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933235\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-external-snapshotter-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933251\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-external-snapshotter-sidecar-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783537955\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-multicluster-console-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933417\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-multicluster-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783537742\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-must-gather-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782933602\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odf-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783019377\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odr-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782934054\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odr-volsync-plugin-mover-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782934036\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/odr-volsync-plugin-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4.22::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4.22\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782934284\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"odf4/rook-ceph-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:exploit_intelligence:0\"], \"vendor\": \"Red Hat\", \"product\": \"Exploit Intelligence\", \"packageName\": \"exploit-intelligence-tech-preview/agent-client-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/assisted-service-8-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/assisted-service-9-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/cluster-api-provider-azure-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2\", \"packageName\": \"rhacm2/acm-grafana-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:5\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 5\", \"packageName\": \"rhceph/rhceph-5-dashboard-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 7\", \"packageName\": \"rhceph/grafana-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 8\", \"packageName\": \"rhceph/grafana-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ceph_storage:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ceph Storage 9\", \"packageName\": \"rhceph/grafana-rhel10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"containers-common\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"grype\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"opentelemetry-collector-contrib\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"syft\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"trivy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-argoexec-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-llmisvc-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-router-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mod-arch-model-registry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-metadata-collection-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-model-registry-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-must-gather-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-rocm64-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-training-cuda128-torch29-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/rhai-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-agent-installer-api-server-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-agent-installer-api-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-azure-cluster-api-controllers-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-gcp-cluster-api-controllers-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-openstack-cluster-api-controllers-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3\", \"packageName\": \"rhosdt/opentelemetry-collector-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-05T02:00:54.488Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-05T00:35:50.563Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:42852: Multicluster Global Hub 1.5.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:51057: OpenShift Developer Tools and Services 1.6.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41030: Red Hat multicluster global hub 1.4.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:44622: Red Hat multicluster global hub 1.6.0\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-05T00:35:50.563Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-41567\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2485356\", \"name\": \"RHBZ#2485356\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42852\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:51057\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37387\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41030\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:44622\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-427\", \"description\": \"Uncontrolled Search Path Element\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-09-04T12:04:45.511Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-41567\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-05T13:11:38.173928Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-05T13:11:42.359Z\"}}], \"cna\": {\"title\": \"Docker: `PUT /containers/{id}/archive` executes container binary on the host\", \"source\": {\"advisory\": \"GHSA-x86f-5xw2-fm2r\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"moby\", \"product\": \"moby/v2/daemon\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.0.0-beta.14\"}]}, {\"vendor\": \"moby\", \"product\": \"Docker Engine\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 29.5.1\"}]}, {\"vendor\": \"docker\", \"product\": \"docker/daemon\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 28.5.2\"}]}], \"references\": [{\"url\": \"https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r\", \"name\": \"https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-427\", \"description\": \"CWE-427: Uncontrolled Search Path Element\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-05T00:35:50.563Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-41567\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-04T12:04:45.511Z\", \"dateReserved\": \"2026-04-21T14:15:21.957Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-05T00:35:50.563Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:41030
Vulnerability from csaf_redhat - Published: 2026-07-16 14:28 - Updated: 2026-09-06 17:56Summary
Red Hat Security Advisory: Multicluster Global Hub 1.4.7 security update
Severity
Important
Notes
Topic: Multicluster Global Hub v1.4.7 general availability release images, which provide security fixes, bug fixes, and updated container images.
Red Hat Product Security has rated this update as having a security impact of Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system's CPU is consumed indefinitely until the process is terminated.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.
8.8 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.
8.2 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le | — |
Threats
Impact
Important
References
100 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.4.7 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:41030",
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41567",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43870",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46384",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46385",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53492",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41030.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.4.7 security update",
"tracking": {
"current_release_date": "2026-09-06T17:56:52+00:00",
"generator": {
"date": "2026-09-06T17:56:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:41030",
"initial_release_date": "2026-07-16T14:28:53+00:00",
"revision_history": [
{
"date": "2026-07-16T14:28:53+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T17:56:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Multicluster Global Hub 1.4.5",
"product": {
"name": "Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Multicluster Global Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784060681"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Ac083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784061472"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aaec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784061010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3Adbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1784064050"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784060515"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784061953"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784060681"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Ab236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784061472"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784061010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Aa04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784060515"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784061953"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Adcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784060681"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784061472"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Adfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784061010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Adcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784060515"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784061953"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784060681"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784061472"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784061010"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784060515"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784061953"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64 as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x as a component of Multicluster Global Hub 1.4.5",
"product_id": "Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.4.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-41567",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-06-05T02:00:54.488930+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2485356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "RHBZ#2485356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r"
}
],
"release_date": "2026-06-05T00:35:50.563000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-43870",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-05T09:01:02.388589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466671"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache Thrift allows a remote attacker to trigger a denial of service through uncontrolled resource consumption. Additionally, the vulnerability enables path traversal for unauthorized file access and HTTP request/response splitting, potentially leading to further web-based attacks in Red Hat products that integrate Apache Thrift.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "RHBZ#2466671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466671"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy",
"url": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy"
}
],
"release_date": "2026-05-05T07:45:35.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities"
},
{
"cve": "CVE-2026-46384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-29T21:02:03.061736+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483482"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects multiple Avro decoder code paths in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing malformed or excessively large integer values that trigger unsafe integer truncation, arithmetic overflow conditions, or invalid memory allocation operations during decoding.\n\nThe vulnerability affects both 32-bit specific integer narrowing paths and several cross-platform arithmetic overflow conditions. There is only a denial-of-service impact but not confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "RHBZ#2483482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv"
}
],
"release_date": "2026-05-29T19:58:21.535000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder"
},
{
"cve": "CVE-2026-46385",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-05-29T21:01:37.087371+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483475"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system\u0027s CPU is consumed indefinitely until the process is terminated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Avro array and map decoding functionality in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing excessively large block-count values followed by truncated or invalid data. Because the decoder continued iterating after the underlying reader entered an error state, affected applications may consume excessive CPU resources for extended periods of time, potentially leading to denial of service.\n\nThe currently available analysis demonstrates CPU exhaustion and service disruption but does not demonstrate confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "RHBZ#2483475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483475"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w"
}
],
"release_date": "2026-05-29T19:58:59.667000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration"
},
{
"cve": "CVE-2026-53488",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-07-01T02:01:09.589815+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "RHBZ#2495815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
}
],
"release_date": "2026-07-01T00:11:20.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"category": "workaround",
"details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
},
{
"cve": "CVE-2026-53492",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-01T19:01:34.238078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496130"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd\u0027s Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "RHBZ#2496130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"
}
],
"release_date": "2026-07-01T17:59:12.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-16T14:28:53+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:5e37720cef2fa6b617ee4f13dd20b52ffd6ea1f40d344fbed5a9ee13062100db_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7430c54c9069fb79c4868fd138d9b32aca5c5b7bdc664b8c4867c88f368794b1_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b236a391dc18a1318246f2f2dafd51046e9775e27da59062285160182c433b37_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c083ca3a199fb2526f8c5bd289360c564190d03bb62442b9b8ee1bbaf50b5ddb_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:46d3139333312711d3a5182fa39faa17f55ad958705d5cac251d4368c19ea10c_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:7ea29573411a624258921e47724e74d5990e08961d439b570fa7e514ca1e089e_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8f60851c9d3e9cb1acd491f76b9e69ed960a0aa2aef05150db679e77041c6db0_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:dcf3c795131a0ad5d23d84cf75624bc6a218b92fc7f77d315f09abd13043af99_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:171f3dd702df169e177e19a280f7a3ac7ec39b7314803bd79e75899458537f45_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:725f309bda18524c827f0c7f62f54b0deccd6ea913f09f18ca425b8a629fc079_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:aec321001dc697520c69f4a895cf4e7f586588dc9ff4bdafee7174ec845bf981_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dfcfdb1ecacd9bb6f5c869f738a72f59b29374dedfbc70a2a110b9c3ed2030d5_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:dbf88c1d7dcc954af16930554e98740784793d4147ffb249d06b79f2a7402d47_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:060d3bfc8a2c8a26e2900198c08ad7a6c7483ef97ffbae7d76d557be77aa5e1b_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:36cf715173a544f464ab1eab439d75bda3d3b02fc4d54038243edfce5b177d4a_s390x",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5207c10c701c09e2497976ba70543a66e1ec8141603cb970dfd7ec26414eab65_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9f621dbba78c2f72b74a16a23f29f0630d0527737abbf7a2cf62ffdd1bab236b_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:4a57e975be3e638d774e9f0e9d2608f528636185b2fbac6c08d058be74211d9f_amd64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5eb9f34c615982831061c9d24e978cd54e4fd40f34224dcad3f447003f63dfaa_arm64",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a04a325cde0fc3eeccbdcf6e942df306865ca7ccfb734160ea06dc204d5dbc02_ppc64le",
"Multicluster Global Hub 1.4.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dcef91d3059252532c053a368a234c137851a89f348d37f61c85cc12ff58250b_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration."
}
]
}
RHSA-2026:42852
Vulnerability from csaf_redhat - Published: 2026-07-21 14:36 - Updated: 2026-09-06 17:57Summary
Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update
Severity
Important
Notes
Topic: Multicluster Global Hub v1.5.6 general availability release images, which provide security fixes, bug fixes, and updated container images.
Red Hat Product Security has rated this update as having a security impact of Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system's CPU is consumed indefinitely until the process is terminated.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.
8.8 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.
8.2 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le | — | ||
| Unresolved product id: Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 | — |
Threats
Impact
Important
References
103 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.5.6 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42852",
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33376",
"url": "https://access.redhat.com/security/cve/CVE-2026-33376"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33377",
"url": "https://access.redhat.com/security/cve/CVE-2026-33377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41567",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43870",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46384",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46385",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53492",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42852.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.5.6 security update",
"tracking": {
"current_release_date": "2026-09-06T17:57:00+00:00",
"generator": {
"date": "2026-09-06T17:57:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:42852",
"initial_release_date": "2026-07-21T14:36:23+00:00",
"revision_history": [
{
"date": "2026-07-21T14:36:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T17:57:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat multicluster global hub 1.5.1",
"product": {
"name": "Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat multicluster global hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Af58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784562060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784127491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784128029"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1784565261"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784127524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784127173"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Aecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784562060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784127491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Addfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784128029"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ac00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784127524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ab22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784127173"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784562060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784127491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784128029"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Aedd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784127524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784127173"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784562060"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784127491"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Adbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784128029"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784127524"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ac6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784127173"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64 as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x as a component of Red Hat multicluster global hub 1.5.1",
"product_id": "Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x",
"relates_to_product_reference": "Red Hat multicluster global hub 1.5.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-33376",
"cwe": {
"id": "CWE-183",
"name": "Permissive List of Allowed Inputs"
},
"discovery_date": "2026-05-13T20:02:51.602978+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477262"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list defaults to an overly broad /32 mask, potentially allowing unauthorized access. This strictly affects Auth Proxy deployments using IPv6 allow-lists; other authentication methods are unaffected. This has been rated moderate since auth proxy authentication is not enabled by default on grafana shipped on RHEL.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33376"
},
{
"category": "external",
"summary": "RHBZ#2477262",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477262"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33376"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-33376",
"url": "https://grafana.com/security/security-advisories/cve-2026-33376"
}
],
"release_date": "2026-05-13T19:28:34.473000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "To mitigate this issue, explicitly specify the intended IPv6 address mask\u2014typically /128 for a single host\u2014within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended.\nFor RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default"
},
{
"cve": "CVE-2026-33377",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"discovery_date": "2026-05-13T20:02:01.027996+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477246"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana: Privilege escalation via dashboard overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A privilege escalation flaw exists in Grafana, allowing an authenticated editor with write access to a dashboard to overwrite other dashboards not owned by them. This grants the editor administrative control over the targeted dashboard, potentially leading to unauthorized data manipulation or exposure within the Grafana environment.\n\nRed Hat\u0027s default deployment does not grant edit access to normal users. Hence, this is rated moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33377"
},
{
"category": "external",
"summary": "RHBZ#2477246",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477246"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-33377",
"url": "https://grafana.com/security/security-advisories/cve-2026-33377"
}
],
"release_date": "2026-05-13T19:28:28.154000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: Grafana: Privilege escalation via dashboard overwrite"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-41567",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-06-05T02:00:54.488930+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2485356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "RHBZ#2485356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r"
}
],
"release_date": "2026-06-05T00:35:50.563000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-43870",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-05T09:01:02.388589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466671"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache Thrift allows a remote attacker to trigger a denial of service through uncontrolled resource consumption. Additionally, the vulnerability enables path traversal for unauthorized file access and HTTP request/response splitting, potentially leading to further web-based attacks in Red Hat products that integrate Apache Thrift.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "RHBZ#2466671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466671"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy",
"url": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy"
}
],
"release_date": "2026-05-05T07:45:35.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities"
},
{
"cve": "CVE-2026-46384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-29T21:02:03.061736+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483482"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects multiple Avro decoder code paths in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing malformed or excessively large integer values that trigger unsafe integer truncation, arithmetic overflow conditions, or invalid memory allocation operations during decoding.\n\nThe vulnerability affects both 32-bit specific integer narrowing paths and several cross-platform arithmetic overflow conditions. There is only a denial-of-service impact but not confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "RHBZ#2483482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv"
}
],
"release_date": "2026-05-29T19:58:21.535000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder"
},
{
"cve": "CVE-2026-46385",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-05-29T21:01:37.087371+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483475"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system\u0027s CPU is consumed indefinitely until the process is terminated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Avro array and map decoding functionality in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing excessively large block-count values followed by truncated or invalid data. Because the decoder continued iterating after the underlying reader entered an error state, affected applications may consume excessive CPU resources for extended periods of time, potentially leading to denial of service.\n\nThe currently available analysis demonstrates CPU exhaustion and service disruption but does not demonstrate confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "RHBZ#2483475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483475"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w"
}
],
"release_date": "2026-05-29T19:58:59.667000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration"
},
{
"cve": "CVE-2026-53488",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-07-01T02:01:09.589815+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "RHBZ#2495815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
}
],
"release_date": "2026-07-01T00:11:20.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "workaround",
"details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
},
{
"cve": "CVE-2026-53492",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-01T19:01:34.238078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496130"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd\u0027s Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"known_not_affected": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "RHBZ#2496130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"
}
],
"release_date": "2026-07-01T17:59:12.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T14:36:23+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index",
"product_ids": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2e071c3bb6f1fec229b53557556feffaa8f3137fbf50444ddbf50eb99eacb571_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:65b21ad0d3524d3646d256224376d5cdc6e168ca4a888211a6544448c3d1ba5b_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:802fab4ed4895751fae71a3f1ca7402e73a95a8cbf31bc83d3935ed2b27886f2_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8f43a432db2cd48fa4af89f053fbfec80cbe295f4682ae6a67ce51971fa96d3e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:534f21b4fa204a463f8bef0ed54eee2bf66e549e92ede32dad3ae67a32779b3c_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8a0d6dd45f38bf49e18944c3dd487035b4866e36453bd2a322918ce03f2262db_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:ecae6850a68896cf10e7c2c2b9d23987ee2b9108618a33b98d8a372d3649dd6a_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f58b750ede7e9dbce58f763c6cdf74901499619a15fe8f57590ea647f08267ad_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:371474d8fe061de9129e2f8f65058c179aa1f9f19c6d1acb671235b22551e8af_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:dbabc66991a633163cc07ee1e104bd2bf1ae52eb85ac2efd9d9d1c400b1be30c_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ddfcd7a87576306c460973e055aa4cc592c8240387e8e391b5cfe79810f42d82_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ff3090c12380fbd77d9e6932395658624332c0ef37498a608332f89dcd82a630_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:8938c8e6627cc3065ad04d5dc3eb29114de2c1fc7a13b49204f0103bbb0411c8_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:085bed6a41ccdfcc6a12f1156171c9c53c9f3c7c25b660b8f5cf482f5a3f76b4_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:7ebd83b265ed7bafc8461909844f8d7cdde691a3c69a5dd6646adb26b281ca8e_s390x",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b22867f265404f708b8c920f351b5c0e0afe02ab4aa99dc28ed7232ad70a5981_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6b8fdbc7880fbf5473375970fa34430ab5607d8d0a3da27e61bcfdc7fabed54_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:749ad711d2e6d877684eff67674dafccac43d15ea372fcd5898d2eb53a1767e4_arm64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:7cddde99d5db412a174f95bc15f568d4a2f7ecf3c00736ae777414ebd28d7efc_amd64",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:c00c88c6bb1adfc7b06c930e30121cdc9ec783ca88582789d7844f399f1a5730_ppc64le",
"Red Hat multicluster global hub 1.5.1:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:edd270e4b896aa26e6d7f5b4a8a8cc0143bca3e8fb64c232dc09b238a877e8c0_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration."
}
]
}
RHSA-2026:44622
Vulnerability from csaf_redhat - Published: 2026-07-23 18:36 - Updated: 2026-09-06 17:57Summary
Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update
Severity
Important
Notes
Topic: Multicluster Global Hub v1.6.4 general availability release images, which provide security fixes, bug fixes, and updated container images.
Red Hat Product Security has rated this update as having a security impact of Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.
7.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system's CPU is consumed indefinitely until the process is terminated.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.
8.8 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.
8.2 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Vendor Fix
fix
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Threats
Impact
Important
A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 | — |
Workaround
|
Threats
Impact
Important
References
118 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.6.4 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:44622",
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33376",
"url": "https://access.redhat.com/security/cve/CVE-2026-33376"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33377",
"url": "https://access.redhat.com/security/cve/CVE-2026-33377"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41567",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43870",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46384",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46385",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-53492",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55677",
"url": "https://access.redhat.com/security/cve/CVE-2026-55677"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44622.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.6.4 security update",
"tracking": {
"current_release_date": "2026-09-06T17:57:04+00:00",
"generator": {
"date": "2026-09-06T17:57:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:44622",
"initial_release_date": "2026-07-23T18:36:47+00:00",
"revision_history": [
{
"date": "2026-07-23T18:36:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T17:57:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Multicluster Global Hub 1.6.5",
"product": {
"name": "Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
}
}
}
],
"category": "product_family",
"name": "Multicluster Global Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Af7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784561376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Aba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784152046"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Ae9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784151884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1784728578"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Af356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784151772"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Aeefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784152164"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784561376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784152046"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784151884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784151772"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784152164"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784561376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784152046"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Abbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784151884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784151772"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784152164"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Ae7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1784561376"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1784152046"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Af4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1784151884"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1784151772"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1784152164"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64 as a component of Multicluster Global Hub 1.6.5",
"product_id": "Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33376",
"cwe": {
"id": "CWE-183",
"name": "Permissive List of Allowed Inputs"
},
"discovery_date": "2026-05-13T20:02:51.602978+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477262"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list defaults to an overly broad /32 mask, potentially allowing unauthorized access. This strictly affects Auth Proxy deployments using IPv6 allow-lists; other authentication methods are unaffected. This has been rated moderate since auth proxy authentication is not enabled by default on grafana shipped on RHEL.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33376"
},
{
"category": "external",
"summary": "RHBZ#2477262",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477262"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33376"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-33376",
"url": "https://grafana.com/security/security-advisories/cve-2026-33376"
}
],
"release_date": "2026-05-13T19:28:34.473000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "To mitigate this issue, explicitly specify the intended IPv6 address mask\u2014typically /128 for a single host\u2014within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended.\nFor RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default"
},
{
"cve": "CVE-2026-33377",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"discovery_date": "2026-05-13T20:02:01.027996+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477246"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Grafana: Privilege escalation via dashboard overwrite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A privilege escalation flaw exists in Grafana, allowing an authenticated editor with write access to a dashboard to overwrite other dashboards not owned by them. This grants the editor administrative control over the targeted dashboard, potentially leading to unauthorized data manipulation or exposure within the Grafana environment.\n\nRed Hat\u0027s default deployment does not grant edit access to normal users. Hence, this is rated moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33377"
},
{
"category": "external",
"summary": "RHBZ#2477246",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477246"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-33377",
"url": "https://grafana.com/security/security-advisories/cve-2026-33377"
}
],
"release_date": "2026-05-13T19:28:28.154000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: Grafana: Privilege escalation via dashboard overwrite"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-41567",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-06-05T02:00:54.488930+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2485356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "RHBZ#2485356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r"
}
],
"release_date": "2026-06-05T00:35:50.563000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to the Prometheus remote read endpoint (/api/v1/read). Configure firewall rules or network policies to permit connections only from trusted internal networks or authorized clients. This action reduces the attack surface by limiting exposure to unauthenticated remote attackers. A service restart or reload may be required for the changes to take effect.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-43870",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-05T09:01:02.388589+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466671"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory (path traversal), and improper neutralization of CRLF sequences in HTTP headers (HTTP request/response splitting). A remote attacker could exploit these issues to trigger uncontrolled resource consumption, leading to a Denial of Service (DoS) condition. Furthermore, path traversal could allow unauthorized access to files, and HTTP request/response splitting might enable other web-based attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Apache Thrift allows a remote attacker to trigger a denial of service through uncontrolled resource consumption. Additionally, the vulnerability enables path traversal for unauthorized file access and HTTP request/response splitting, potentially leading to further web-based attacks in Red Hat products that integrate Apache Thrift.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43870"
},
{
"category": "external",
"summary": "RHBZ#2466671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466671"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43870"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43870"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy",
"url": "https://lists.apache.org/thread/pgtfq44ltc9t63kxcbqmwqzt45pnhqdy"
}
],
"release_date": "2026-05-05T07:45:35.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities"
},
{
"cve": "CVE-2026-46384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-29T21:02:03.061736+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483482"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow flaw was found in Go Avro in decoding logic. Multiple decoder paths performs unsafe integer conversions and overflow-prone arithmetic operations on attacker-controlled values from Avro payloads. A remote attacker during Avro decoder operations could exploit this issue using specially crafted Avro data to consume excessive resources by bypassing memory limits and triggering crashes leading to a denial of service in affected applications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects multiple Avro decoder code paths in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing malformed or excessively large integer values that trigger unsafe integer truncation, arithmetic overflow conditions, or invalid memory allocation operations during decoding.\n\nThe vulnerability affects both 32-bit specific integer narrowing paths and several cross-platform arithmetic overflow conditions. There is only a denial-of-service impact but not confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46384"
},
{
"category": "external",
"summary": "RHBZ#2483482",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483482"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46384"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv"
}
],
"release_date": "2026-05-29T19:58:21.535000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: Integer Overflow in Avro Decoder"
},
{
"cve": "CVE-2026-46385",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-05-29T21:01:37.087371+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483475"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Avro array and map decoding logic in Go Avro. The decoder failed to properly stop processing after encountering read errors while iterating over attacker-controlled block-count values, leading to excessive resource consumption. A remote unauthenticated attacker could exploit this issue using specially crafted Avro payloads causing denial of service, where the affected system\u0027s CPU is consumed indefinitely until the process is terminated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects Avro array and map decoding functionality in affected Go Avro libraries. Red Hat Product Security has assessed this issue as an Important severity vulnerability.\n\nA remote unauthenticated attacker may supply specially crafted Avro payloads containing excessively large block-count values followed by truncated or invalid data. Because the decoder continued iterating after the underlying reader entered an error state, affected applications may consume excessive CPU resources for extended periods of time, potentially leading to denial of service.\n\nThe currently available analysis demonstrates CPU exhaustion and service disruption but does not demonstrate confidentiality or integrity impact. Therefore, Red Hat assessed the impact as limited to Availability (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46385"
},
{
"category": "external",
"summary": "RHBZ#2483475",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483475"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46385"
},
{
"category": "external",
"summary": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w",
"url": "https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w"
}
],
"release_date": "2026-05-29T19:58:59.667000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/hamba/avro/v2: github.com/linkedin/goavro/v2: CPU Exhaustion in Avro Decoder via Unbounded Block-Count Iteration"
},
{
"cve": "CVE-2026-53488",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-07-01T02:01:09.589815+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53488"
},
{
"category": "external",
"summary": "RHBZ#2495815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
}
],
"release_date": "2026-07-01T00:11:20.610000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
},
{
"cve": "CVE-2026-53492",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-01T19:01:34.238078+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496130"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. This vulnerability enables a user with permissions to create pods to bypass standard Kubernetes resource allocation and device plugin enforcement. Consequently, an attacker can inject arbitrary CDI edits, such as device nodes and host mounts, into the restored container, potentially leading to unauthorized resource access or privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. In Red Hat OpenShift Container Platform, a user with pod creation permissions could bypass standard Kubernetes resource allocation and device plugin enforcement. This is due to containerd\u0027s Container Runtime Interface (CRI) improperly trusting Container Device Interface (CDI) annotations during container restoration. Exploitation requires CDI to be enabled on the node and a matching host CDI specification for the requested device.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-53492"
},
{
"category": "external",
"summary": "RHBZ#2496130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-53492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53492"
},
{
"category": "external",
"summary": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc",
"url": "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"
}
],
"release_date": "2026-07-01T17:59:12.552000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration."
},
{
"cve": "CVE-2026-55677",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-26T17:01:45.110038+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493622"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Echo web framework. The discrepancy in URL path decoding between the router and static file handler allows an unauthenticated attacker to bypass access controls and read arbitrary static files. This could lead to the exposure of sensitive data hosted on affected Red Hat products utilizing the Echo framework for serving static content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55677"
},
{
"category": "external",
"summary": "RHBZ#2493622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493622"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677"
},
{
"category": "external",
"summary": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq",
"url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
}
],
"release_date": "2026-06-26T16:15:55.633000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T18:36:47+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:180cae1153b4147f4bde808fa626ce8d1970b11714bcffceed4beab911133ae2_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:3386cafd13a0483523176f34c1a0ff5b1d3bc3f99f16504eaf4f250ec25aab1f_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6c4c5ba04f69becfcdfa348fd79ec31e350bc9b3d6a49a5bc2db372852b25c33_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba8baef02a1434c484823b4a913daab81dcc2a590aedad6296e790848522a733_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:195e3f89eee8e33fadedb701918846da6ab1c9e0edf23718e0bf024995f09977_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:21ea61d1524280f483fe2b55f17d4d5510c21e207c6403fa4e5e248f39f70b5c_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e7aaef898bce215f645dc0b8e28414509bf5dd5805720c6380548f1ab32907cd_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:f7c4bbfa958c00f1f43e8d4470c4b11ee7c5558e1f2df707ca45e179370c3103_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ae7687a09a81bcf3e2ebe5e3eb08eeddcd600fee1c029a65d99f856084496e1a_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:bbb16ee5a4823ff1d28b7e8696c0dfef512b56421c71bfb3d62a61c1279bf6c0_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e9b6deffc1ea8be6e26d391f2d11be1391151884fff5c41be3b6cd65d07b7fd0_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f4184cf8175d4f48ef1ad3fed2a8c337a713a01115ae00d27af199246b920dd6_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:2e53eabb0d89de4dc25f6575124918826b066da62f149b71cde4ebb6e806375c_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:199581add540c329289b169a80c95ffd3fa56bb0e504ca2c2723ef7297b7910f_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2bf5a1d79ec3b811cd70156ad6476b3c5519d17358f24c0d0fbf5118793bb116_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:3450dc352b5b27412c5069896f5fdb2f3d1a0085a3947fd21e30deef90c09392_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:eefe132d48f531b38e721a246daeded5f0b7d4616d8f9ad0c16cb128b4812b86_amd64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3641c6586eb7c7c808dd2a90a51b0659112136189fe71a392fc1a786df647da9_s390x",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:40c094dbef73513e773ac085242e20cc395591790ed103937a178197ffafab50_arm64",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:43a86eefdd0fdc6fc7e2958138e27979d64443f564d1c32bd92804de96546c6c_ppc64le",
"Multicluster Global Hub 1.6.5:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f356b6ca990f7fb11fd1ada512bbd01f17fa48690b801214c2785dea430d9d7d_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy"
}
]
}
RHSA-2026:51057
Vulnerability from csaf_redhat - Published: 2026-08-06 11:09 - Updated: 2026-09-06 17:57Summary
Red Hat Security Advisory: OpenShift Source To Image 1.6.3
Severity
Important
Notes
Topic: OpenShift Source To Image 1.6.3 Release
Details: Release of OpenShift Source To Image 1.6.3
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container's filesystem. This allows an attacker to gain complete control over the affected system.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.
7.2 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
41 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "OpenShift Source To Image 1.6.3 Release",
"title": "Topic"
},
{
"category": "general",
"text": "Release of OpenShift Source To Image 1.6.3",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:51057",
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27145",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41567",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42306",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51057.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Source To Image 1.6.3",
"tracking": {
"current_release_date": "2026-09-06T17:57:25+00:00",
"generator": {
"date": "2026-09-06T17:57:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:51057",
"initial_release_date": "2026-08-06T11:09:37+00:00",
"revision_history": [
{
"date": "2026-08-06T11:09:37+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-04T00:36:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-06T17:57:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Developer Tools and Services 1.6.3",
"product": {
"name": "OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:source_to_image:1.6::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Developer Tools and Services"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel8@sha256%3A165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346?arch=amd64\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel8\u0026tag=1784727697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel9@sha256%3A2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e?arch=amd64\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel9\u0026tag=1784728036"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel8@sha256%3A3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d?arch=arm64\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel8\u0026tag=1784727697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel9@sha256%3Afc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860?arch=arm64\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel9\u0026tag=1784728036"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel8@sha256%3A1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3?arch=ppc64le\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel8\u0026tag=1784727697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel9@sha256%3Ada07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573?arch=ppc64le\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel9\u0026tag=1784728036"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel8@sha256%3Af3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0?arch=s390x\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel8\u0026tag=1784727697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"product": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"product_id": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/source-to-image-rhel9@sha256%3Ac2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3?arch=s390x\u0026repository_url=registry.redhat.io/source-to-image/source-to-image-rhel9\u0026tag=1784728036"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64 as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64 as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64 as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64 as a component of OpenShift Developer Tools and Services 1.6.3",
"product_id": "OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
},
"product_reference": "registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64",
"relates_to_product_reference": "OpenShift Developer Tools and Services 1.6.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:09:37+00:00",
"details": "It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.3",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:09:37+00:00",
"details": "It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.3",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-41567",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-06-05T02:00:54.488930+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2485356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, the open-source container framework, and Docker Engine. A malicious container image can exploit this vulnerability to achieve arbitrary code execution with full daemon privileges, including host root access. This occurs when a user uploads a compressed archive to the container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This allows an attacker to gain complete control over the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability. A flaw in Moby and Docker Engine allows for arbitrary code execution with host root privileges. This occurs when a user uploads a compressed archive to a container, as the daemon incorrectly uses decompression binaries from the container\u0027s filesystem. This could lead to a complete compromise of the host system if a malicious container image is utilized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "RHBZ#2485356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41567"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r"
}
],
"release_date": "2026-06-05T00:35:50.563000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:09:37+00:00",
"details": "It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.3",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "workaround",
"details": "To mitigate this issue, Red Hat recommends only running containers from trusted images. Additionally, users should avoid piping compressed archives into containers created from untrusted images. For environments utilizing authorization plugins, restricting access to the `PUT /containers/{id}/archive` endpoint can further reduce exposure.",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload"
},
{
"cve": "CVE-2026-42306",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-06-12T19:01:10.843543+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488484"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Moby container framework. A race condition occurs during the `docker cp` mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could overwrite host files, potentially leading to data corruption or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Moby container framework where a race condition during `docker cp` mount setup could allow a malicious container to overwrite arbitrary host files. Exploitation requires an attacker to have control over a running container, which could lead to data corruption or denial of service on the host system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42306"
},
{
"category": "external",
"summary": "RHBZ#2488484",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488484"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42306"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42306"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh",
"url": "https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"
}
],
"release_date": "2026-06-12T18:09:22.188000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:09:37+00:00",
"details": "It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.3",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T11:09:37+00:00",
"details": "It is recommended that existing users of OpenShift Source To Image upgrade to v1.6.3",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:165efe95829019cfa2262f929dce52ea95ff83ce495309726aad336fbdd5e346_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:1fa54de6f9a2b2637715ba73efae4cd31eb2be55121ffdf33306d2cafc7cbdd3_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:3891a8717d05c5fd308ed4b3b09d53b793f5bddfadc365f7c07e597b5a14ce4d_arm64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel8@sha256:f3f19ccbae2990e1b0b5c366f880b1c1eb2a5f7515a4017f4fe6c9b089bf27d0_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:2a8a7fcaf8cb0acc0a2a66a46338887ca8a9823adc1d5fe29f2440560895ff7e_amd64",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:c2321623908f1bbc2b353b7fd50cf30835511ef2715b00df1362edca3c8476a3_s390x",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:da07963beb33a34655d8aa1bf7c9b37b2c63d572d2689cf934243da5a2578573_ppc64le",
"OpenShift Developer Tools and Services 1.6.3:registry.redhat.io/source-to-image/source-to-image-rhel9@sha256:fc22e7614d51d5a1f809cdea32979acec0e05361cdfd94ac773d269f473e6860_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
}
]
}
SUSE-SU-2026:22285-1
Vulnerability from csaf_suse - Published: 2026-06-25 12:44 - Updated: 2026-06-25 12:44Summary
Security update for docker
Severity
Important
Notes
Title of the patch: Security update for docker
Description of the patch: This update for docker fixes the following issues
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Patchnames: SUSE-SL-Micro-6.2-1081
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.2 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
21 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for docker",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for docker fixes the following issues\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265782).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266625).\n- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be\n used to bypass some authorization controls (bsc#1262346).\n- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into\n that container (bsc#1267827).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-1081",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22285-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22285-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622285-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22285-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047673.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262346",
"url": "https://bugzilla.suse.com/1262346"
},
{
"category": "self",
"summary": "SUSE Bug 1265782",
"url": "https://bugzilla.suse.com/1265782"
},
{
"category": "self",
"summary": "SUSE Bug 1266625",
"url": "https://bugzilla.suse.com/1266625"
},
{
"category": "self",
"summary": "SUSE Bug 1267827",
"url": "https://bugzilla.suse.com/1267827"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39984 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39984/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41567 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41567/"
}
],
"title": "Security update for docker",
"tracking": {
"current_release_date": "2026-06-25T12:44:31Z",
"generator": {
"date": "2026-06-25T12:44:31Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22285-1",
"initial_release_date": "2026-06-25T12:44:31Z",
"revision_history": [
{
"date": "2026-06-25T12:44:31Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.aarch64",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.aarch64",
"product_id": "docker-29.4.0_ce-160000.7.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.aarch64",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.aarch64",
"product_id": "docker-buildx-0.33.0-160000.7.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.ppc64le",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.ppc64le",
"product_id": "docker-29.4.0_ce-160000.7.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"product_id": "docker-buildx-0.33.0-160000.7.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.s390x",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.s390x",
"product_id": "docker-29.4.0_ce-160000.7.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.s390x",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.s390x",
"product_id": "docker-buildx-0.33.0-160000.7.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.x86_64",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.x86_64",
"product_id": "docker-29.4.0_ce-160000.7.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.x86_64",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.x86_64",
"product_id": "docker-buildx-0.33.0-160000.7.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39984",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39984"
}
],
"notes": [
{
"category": "general",
"text": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39984",
"url": "https://www.suse.com/security/cve/CVE-2026-39984"
},
{
"category": "external",
"summary": "SUSE Bug 1262338 for CVE-2026-39984",
"url": "https://bugzilla.suse.com/1262338"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-39984"
},
{
"cve": "CVE-2026-41567",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41567"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41567",
"url": "https://www.suse.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "SUSE Bug 1267827 for CVE-2026-41567",
"url": "https://bugzilla.suse.com/1267827"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Micro 6.2:docker-buildx-0.33.0-160000.7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-41567"
}
]
}
SUSE-SU-2026:22367-1
Vulnerability from csaf_suse - Published: 2026-06-25 12:44 - Updated: 2026-06-25 12:44Summary
Security update for docker
Severity
Important
Notes
Title of the patch: Security update for docker
Description of the patch: This update for docker fixes the following issues
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Patchnames: SUSE-SLES-16.0-1081
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.2 (High)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
21 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for docker",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for docker fixes the following issues\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265782).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266625).\n- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be\n used to bypass some authorization controls (bsc#1262346).\n- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into\n that container (bsc#1267827).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1081",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22367-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22367-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622367-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22367-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047772.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262346",
"url": "https://bugzilla.suse.com/1262346"
},
{
"category": "self",
"summary": "SUSE Bug 1265782",
"url": "https://bugzilla.suse.com/1265782"
},
{
"category": "self",
"summary": "SUSE Bug 1266625",
"url": "https://bugzilla.suse.com/1266625"
},
{
"category": "self",
"summary": "SUSE Bug 1267827",
"url": "https://bugzilla.suse.com/1267827"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39984 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39984/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41567 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41567/"
}
],
"title": "Security update for docker",
"tracking": {
"current_release_date": "2026-06-25T12:44:31Z",
"generator": {
"date": "2026-06-25T12:44:31Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22367-1",
"initial_release_date": "2026-06-25T12:44:31Z",
"revision_history": [
{
"date": "2026-06-25T12:44:31Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.aarch64",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.aarch64",
"product_id": "docker-29.4.0_ce-160000.7.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.aarch64",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.aarch64",
"product_id": "docker-buildx-0.33.0-160000.7.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"product": {
"name": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"product_id": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"product": {
"name": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"product_id": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"product": {
"name": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"product_id": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch"
}
},
{
"category": "product_version",
"name": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"product": {
"name": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"product_id": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.ppc64le",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.ppc64le",
"product_id": "docker-29.4.0_ce-160000.7.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"product_id": "docker-buildx-0.33.0-160000.7.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.s390x",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.s390x",
"product_id": "docker-29.4.0_ce-160000.7.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.s390x",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.s390x",
"product_id": "docker-buildx-0.33.0-160000.7.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-160000.7.1.x86_64",
"product": {
"name": "docker-29.4.0_ce-160000.7.1.x86_64",
"product_id": "docker-29.4.0_ce-160000.7.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-160000.7.1.x86_64",
"product": {
"name": "docker-buildx-0.33.0-160000.7.1.x86_64",
"product_id": "docker-buildx-0.33.0-160000.7.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-160000.7.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64"
},
"product_reference": "docker-29.4.0_ce-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-160000.7.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64"
},
"product_reference": "docker-buildx-0.33.0-160000.7.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
},
"product_reference": "docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39984",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39984"
}
],
"notes": [
{
"category": "general",
"text": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39984",
"url": "https://www.suse.com/security/cve/CVE-2026-39984"
},
{
"category": "external",
"summary": "SUSE Bug 1262338 for CVE-2026-39984",
"url": "https://bugzilla.suse.com/1262338"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "moderate"
}
],
"title": "CVE-2026-39984"
},
{
"cve": "CVE-2026-41567",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41567"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41567",
"url": "https://www.suse.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "SUSE Bug 1267827 for CVE-2026-41567",
"url": "https://bugzilla.suse.com/1267827"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-29.4.0_ce-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-bash-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-buildx-0.33.0-160000.7.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-fish-completion-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-rootless-extras-29.4.0_ce-160000.7.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:docker-zsh-completion-29.4.0_ce-160000.7.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T12:44:31Z",
"details": "important"
}
],
"title": "CVE-2026-41567"
}
]
}
SUSE-SU-2026:22456-1
Vulnerability from csaf_suse - Published: 2026-06-30 11:41 - Updated: 2026-06-30 11:41Summary
Security update for docker
Severity
Important
Notes
Title of the patch: Security update for docker
Description of the patch: This update for docker fixes the following issues
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be
used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into
that container (bsc#1267827).
Patchnames: SUSE-SLE-Micro-6.1-605
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.2 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
21 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for docker",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for docker fixes the following issues\n\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265782).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266625).\n- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be\n used to bypass some authorization controls (bsc#1262346).\n- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into\n that container (bsc#1267827).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-605",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22456-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22456-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622456-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22456-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027252.html"
},
{
"category": "self",
"summary": "SUSE Bug 1262346",
"url": "https://bugzilla.suse.com/1262346"
},
{
"category": "self",
"summary": "SUSE Bug 1265782",
"url": "https://bugzilla.suse.com/1265782"
},
{
"category": "self",
"summary": "SUSE Bug 1266625",
"url": "https://bugzilla.suse.com/1266625"
},
{
"category": "self",
"summary": "SUSE Bug 1267827",
"url": "https://bugzilla.suse.com/1267827"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39984 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39984/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41567 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41567/"
}
],
"title": "Security update for docker",
"tracking": {
"current_release_date": "2026-06-30T11:41:11Z",
"generator": {
"date": "2026-06-30T11:41:11Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22456-1",
"initial_release_date": "2026-06-30T11:41:11Z",
"revision_history": [
{
"date": "2026-06-30T11:41:11Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"product": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"product_id": "docker-29.4.0_ce-slfo.1.1_10.1.aarch64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"product": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"product_id": "docker-buildx-0.33.0-slfo.1.1_10.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"product": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"product_id": "docker-29.4.0_ce-slfo.1.1_10.1.ppc64le"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"product": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"product_id": "docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"product": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"product_id": "docker-29.4.0_ce-slfo.1.1_10.1.s390x"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"product": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"product_id": "docker-buildx-0.33.0-slfo.1.1_10.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"product": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"product_id": "docker-29.4.0_ce-slfo.1.1_10.1.x86_64"
}
},
{
"category": "product_version",
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.x86_64",
"product": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.x86_64",
"product_id": "docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64"
},
"product_reference": "docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le"
},
"product_reference": "docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x"
},
"product_reference": "docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-29.4.0_ce-slfo.1.1_10.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64"
},
"product_reference": "docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64"
},
"product_reference": "docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le"
},
"product_reference": "docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x"
},
"product_reference": "docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "docker-buildx-0.33.0-slfo.1.1_10.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
},
"product_reference": "docker-buildx-0.33.0-slfo.1.1_10.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-30T11:41:11Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-30T11:41:11Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39984",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39984"
}
],
"notes": [
{
"category": "general",
"text": "Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39984",
"url": "https://www.suse.com/security/cve/CVE-2026-39984"
},
{
"category": "external",
"summary": "SUSE Bug 1262338 for CVE-2026-39984",
"url": "https://bugzilla.suse.com/1262338"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-30T11:41:11Z",
"details": "moderate"
}
],
"title": "CVE-2026-39984"
},
{
"cve": "CVE-2026-41567",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41567"
}
],
"notes": [
{
"category": "general",
"text": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41567",
"url": "https://www.suse.com/security/cve/CVE-2026-41567"
},
{
"category": "external",
"summary": "SUSE Bug 1267827 for CVE-2026-41567",
"url": "https://bugzilla.suse.com/1267827"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-29.4.0_ce-slfo.1.1_10.1.x86_64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.aarch64",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.ppc64le",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.s390x",
"SUSE Linux Micro 6.1:docker-buildx-0.33.0-slfo.1.1_10.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-30T11:41:11Z",
"details": "important"
}
],
"title": "CVE-2026-41567"
}
]
}
ubuntu-cve-2026-41567
Vulnerability from osv_ubuntu
Published
2026-06-05 02:17
Modified
2026-06-30 16:20
Summary
Details
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/{id}/archive or piped through docker cp -, the daemon resolves decompression binaries (such as xz or unpigz) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the PUT /containers/{id}/archive endpoint, and avoiding piping compressed archives into containers created from untrusted images
Severity
7.2 (High)
7.5 (High)
N/A (UNKNOWN)
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "18.09.7-0ubuntu1~16.04.9+esm2"
},
{
"binary_name": "golang-docker-dev",
"binary_version": "18.09.7-0ubuntu1~16.04.9+esm2"
},
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "18.09.7-0ubuntu1~16.04.9+esm2"
},
{
"binary_name": "vim-syntax-docker",
"binary_version": "18.09.7-0ubuntu1~16.04.9+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@18.09.7-0ubuntu1~16.04.9+esm2?arch=source\u0026distro=esm-infra/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.6.2~dfsg1-1ubuntu4",
"1.10.2-0ubuntu3",
"1.10.2-0ubuntu4",
"1.10.3-0ubuntu1",
"1.10.3-0ubuntu4",
"1.10.3-0ubuntu5",
"1.10.3-0ubuntu6",
"1.11.2-0ubuntu5~16.04",
"1.12.1-0ubuntu13~16.04.1",
"1.12.3-0ubuntu4~16.04.2",
"1.12.6-0ubuntu1~16.04.1",
"1.13.1-0ubuntu1~16.04.2",
"17.03.2-0ubuntu2~16.04.1",
"18.06.1-0ubuntu1~16.04.2",
"18.06.1-0ubuntu1.2~16.04.1",
"18.09.2-0ubuntu1~16.04.1",
"18.09.5-0ubuntu1~16.04.2",
"18.09.7-0ubuntu1~16.04.1",
"18.09.7-0ubuntu1~16.04.4",
"18.09.7-0ubuntu1~16.04.5",
"18.09.7-0ubuntu1~16.04.6",
"18.09.7-0ubuntu1~16.04.7",
"18.09.7-0ubuntu1~16.04.9+esm1",
"18.09.7-0ubuntu1~16.04.9+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "20.10.21-0ubuntu1~18.04.3+esm3"
},
{
"binary_name": "golang-docker-dev",
"binary_version": "20.10.21-0ubuntu1~18.04.3+esm3"
},
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "20.10.21-0ubuntu1~18.04.3+esm3"
},
{
"binary_name": "vim-syntax-docker",
"binary_version": "20.10.21-0ubuntu1~18.04.3+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~18.04.3+esm3?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.13.1-0ubuntu6",
"17.03.2-0ubuntu1",
"17.03.2-0ubuntu3",
"17.03.2-0ubuntu5",
"17.12.1-0ubuntu1",
"18.06.1-0ubuntu1~18.04.1",
"18.06.1-0ubuntu1.2~18.04.1",
"18.09.2-0ubuntu1~18.04.1",
"18.09.5-0ubuntu1~18.04.2",
"18.09.7-0ubuntu1~18.04.1",
"18.09.7-0ubuntu1~18.04.3",
"18.09.7-0ubuntu1~18.04.4",
"19.03.6-0ubuntu1~18.04.1",
"19.03.6-0ubuntu1~18.04.2",
"19.03.6-0ubuntu1~18.04.3",
"20.10.2-0ubuntu1~18.04.2",
"20.10.2-0ubuntu1~18.04.3",
"20.10.7-0ubuntu1~18.04.1",
"20.10.7-0ubuntu1~18.04.2",
"20.10.7-0ubuntu5~18.04.2",
"20.10.7-0ubuntu5~18.04.3",
"20.10.12-0ubuntu2~18.04.1",
"20.10.21-0ubuntu1~18.04.2",
"20.10.21-0ubuntu1~18.04.3",
"20.10.21-0ubuntu1~18.04.3+esm1",
"20.10.21-0ubuntu1~18.04.3+esm2",
"20.10.21-0ubuntu1~18.04.3+esm3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-docker-dev",
"binary_version": "20.10.21-0ubuntu1~20.04.6+esm2"
},
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "20.10.21-0ubuntu1~20.04.6+esm2"
},
{
"binary_name": "vim-syntax-docker",
"binary_version": "20.10.21-0ubuntu1~20.04.6+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~20.04.6+esm2?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"19.03.2-0ubuntu1",
"19.03.6-0ubuntu1",
"19.03.8-0ubuntu1",
"19.03.8-0ubuntu1.20.04",
"19.03.8-0ubuntu1.20.04.1",
"19.03.8-0ubuntu1.20.04.2",
"20.10.2-0ubuntu1~20.04.2",
"20.10.2-0ubuntu1~20.04.3",
"20.10.7-0ubuntu1~20.04.1",
"20.10.7-0ubuntu1~20.04.2",
"20.10.7-0ubuntu5~20.04.1",
"20.10.7-0ubuntu5~20.04.2",
"20.10.12-0ubuntu2~20.04.1",
"20.10.21-0ubuntu1~20.04.1",
"20.10.21-0ubuntu1~20.04.2",
"20.10.21-0ubuntu1~20.04.4",
"20.10.21-0ubuntu1~20.04.5",
"20.10.21-0ubuntu1~20.04.6",
"20.10.21-0ubuntu1~20.04.6+esm1",
"20.10.21-0ubuntu1~20.04.6+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "26.1.3-0ubuntu1~20.04.1+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "docker.io-app",
"purl": "pkg:deb/ubuntu/docker.io-app@26.1.3-0ubuntu1~20.04.1+esm2?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"20.10.25-0ubuntu1~20.04.1",
"20.10.25-0ubuntu1~20.04.2",
"24.0.5-0ubuntu1~20.04.1",
"24.0.7-0ubuntu2~20.04.1",
"26.1.3-0ubuntu1~20.04.1",
"26.1.3-0ubuntu1~20.04.1+esm1",
"26.1.3-0ubuntu1~20.04.1+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-docker-dev",
"binary_version": "20.10.21-0ubuntu1~22.04.8+esm1"
},
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "20.10.21-0ubuntu1~22.04.8+esm1"
},
{
"binary_name": "vim-syntax-docker",
"binary_version": "20.10.21-0ubuntu1~22.04.8+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@20.10.21-0ubuntu1~22.04.8+esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"20.10.7-0ubuntu5",
"20.10.7-0ubuntu7",
"20.10.12-0ubuntu1",
"20.10.12-0ubuntu2",
"20.10.12-0ubuntu3",
"20.10.12-0ubuntu3+gke1.24.1",
"20.10.12-0ubuntu4",
"20.10.21-0ubuntu1~22.04.2",
"20.10.21-0ubuntu1~22.04.3",
"20.10.21-0ubuntu1~22.04.5",
"20.10.21-0ubuntu1~22.04.6",
"20.10.21-0ubuntu1~22.04.7",
"20.10.21-0ubuntu1~22.04.7+esm1",
"20.10.21-0ubuntu1~22.04.7+esm2",
"20.10.21-0ubuntu1~22.04.8",
"20.10.21-0ubuntu1~22.04.8+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "29.1.3-0ubuntu3~22.04.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "docker.io-app",
"purl": "pkg:deb/ubuntu/docker.io-app@29.1.3-0ubuntu3~22.04.2?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"20.10.25-0ubuntu1~22.04.1",
"20.10.25-0ubuntu1~22.04.2",
"24.0.5-0ubuntu1~22.04.1",
"24.0.7-0ubuntu2~22.04.1",
"26.1.3-0ubuntu1~22.04.1",
"26.1.3-0ubuntu1~22.04.1+esm1",
"27.5.1-0ubuntu3~22.04.1",
"27.5.1-0ubuntu3~22.04.2",
"28.2.2-0ubuntu1~22.04.1",
"29.1.3-0ubuntu3~22.04.1",
"29.1.3-0ubuntu3~22.04.2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "20.10.25+dfsg1-2ubuntu1.24.04.1+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@20.10.25+dfsg1-2ubuntu1.24.04.1+esm1?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"20.10.24+dfsg1-1ubuntu2",
"20.10.25+dfsg1-2ubuntu1",
"20.10.25+dfsg1-2ubuntu1+esm1",
"20.10.25+dfsg1-2ubuntu1+esm2",
"20.10.25+dfsg1-2ubuntu1.24.04.1",
"20.10.25+dfsg1-2ubuntu1.24.04.1+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "29.1.3-0ubuntu3~24.04.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "docker.io-app",
"purl": "pkg:deb/ubuntu/docker.io-app@29.1.3-0ubuntu3~24.04.2?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"24.0.5-0ubuntu1",
"24.0.7-0ubuntu1",
"24.0.7-0ubuntu2",
"24.0.7-0ubuntu3",
"24.0.7-0ubuntu4",
"24.0.7-0ubuntu4.1",
"26.1.3-0ubuntu1~24.04.1",
"26.1.3-0ubuntu1~24.04.1+esm1",
"27.5.1-0ubuntu3~24.04.1",
"27.5.1-0ubuntu3~24.04.2",
"28.2.2-0ubuntu1~24.04.1",
"29.1.3-0ubuntu3~24.04.1",
"29.1.3-0ubuntu3~24.04.2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "26.1.5+dfsg1-9ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@26.1.5+dfsg1-9ubuntu1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"26.1.5+dfsg1-9ubuntu1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "29.1.3-0ubuntu3~25.10.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "docker.io-app",
"purl": "pkg:deb/ubuntu/docker.io-app@29.1.3-0ubuntu3~25.10.1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"27.5.1-0ubuntu3",
"27.5.1-0ubuntu4",
"28.2.2-0ubuntu1",
"29.1.3-0ubuntu3~25.10.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-github-docker-docker-dev",
"binary_version": "27.5.1+dfsg4-2ubuntu1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "docker.io",
"purl": "pkg:deb/ubuntu/docker.io@27.5.1+dfsg4-2ubuntu1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"26.1.5+dfsg1-9ubuntu1",
"27.5.1+dfsg4-1ubuntu1",
"27.5.1+dfsg4-2ubuntu1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "docker.io",
"binary_version": "29.1.3-0ubuntu4.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "docker.io-app",
"purl": "pkg:deb/ubuntu/docker.io-app@29.1.3-0ubuntu4.1?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"28.2.2-0ubuntu1",
"29.1.2-0ubuntu1",
"29.1.3-0ubuntu1",
"29.1.3-0ubuntu2",
"29.1.3-0ubuntu3",
"29.1.3-0ubuntu4",
"29.1.3-0ubuntu4.1"
]
}
],
"aliases": [],
"details": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container\u0027s filesystem rather than the host\u0027s due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images",
"id": "UBUNTU-CVE-2026-41567",
"modified": "2026-06-30T16:20:59Z",
"published": "2026-06-05T02:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-41567"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41567"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-41567"
]
}
WID-SEC-W-2026-1584
Vulnerability from csaf_certbund - Published: 2026-05-18 22:00 - Updated: 2026-08-31 22:00Summary
docker: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Docker ist eine Open-Source-Software, die dazu verwendet werden kann, Anwendungen mithilfe von Betriebssystemvirtualisierung in Containern zu isolieren.
Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, einen Denial-of-Service-Zustand zu verursachen oder Daten zu manipulieren.
Betroffene Betriebssysteme: - Sonstiges
- UNIX
- Windows
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source docker <29.5.1
Open Source / docker
|
<29.5.1 | ||
|
Dell Secure Connect Gateway <5.36.00.16
Dell / Secure Connect Gateway
|
<5.36.00.16 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Amazon Linux 2
Amazon
|
cpe:/o:amazon:linux_2:-
|
— | |
|
IBM MQ operator
IBM / MQ
|
cpe:/a:ibm:mq:operator
|
operator |
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source docker <29.5.1
Open Source / docker
|
<29.5.1 | ||
|
Dell Secure Connect Gateway <5.36.00.16
Dell / Secure Connect Gateway
|
<5.36.00.16 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Amazon Linux 2
Amazon
|
cpe:/o:amazon:linux_2:-
|
— | |
|
IBM MQ operator
IBM / MQ
|
cpe:/a:ibm:mq:operator
|
operator |
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source docker <29.5.1
Open Source / docker
|
<29.5.1 | ||
|
Dell Secure Connect Gateway <5.36.00.16
Dell / Secure Connect Gateway
|
<5.36.00.16 | ||
|
Debian Linux
Debian
|
cpe:/o:debian:debian_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— | |
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE openSUSE
SUSE
|
cpe:/o:suse:opensuse:-
|
— | |
|
Amazon Linux 2
Amazon
|
cpe:/o:amazon:linux_2:-
|
— | |
|
IBM MQ operator
IBM / MQ
|
cpe:/a:ibm:mq:operator
|
operator |
References
29 references
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Docker ist eine Open-Source-Software, die dazu verwendet werden kann, Anwendungen mithilfe von Betriebssystemvirtualisierung in Containern zu isolieren.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein lokaler Angreifer kann mehrere Schwachstellen in docker ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuf\u00fchren, einen Denial-of-Service-Zustand zu verursachen oder Daten zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-1584 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1584.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-1584 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1584"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-rg2x-37c3-w2rh vom 2026-05-18",
"url": "https://github.com/advisories/GHSA-rg2x-37c3-w2rh"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-vp62-88p7-qqf5 vom 2026-05-18",
"url": "https://github.com/advisories/GHSA-vp62-88p7-qqf5"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-x86f-5xw2-fm2r vom 2026-05-18",
"url": "https://github.com/advisories/GHSA-x86f-5xw2-fm2r"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2DOCKER-2026-126 vom 2026-06-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-126.html"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7277096 vom 2026-06-19",
"url": "https://www.ibm.com/support/pages/node/7277096"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:11075-1 vom 2026-06-23",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L3GFHA5CSPWU2OE4EGWA5PFANSUJLCRB/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:22285-1 vom 2026-06-29",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/027039.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:2692-1 vom 2026-06-30",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-June/027092.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:22367-1 vom 2026-07-01",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027120.html"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:21205-1 vom 2026-07-03",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WWEHFGLIU4ZU4AD5LYCJYP5TY5XDLUDK/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:22456-1 vom 2026-07-03",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027252.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2DOCKER-2026-134 vom 2026-07-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS2DOCKER-2026-134.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2NITRO-ENCLAVES-2026-112 vom 2026-07-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS2NITRO-ENCLAVES-2026-112.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2ECS-2026-131 vom 2026-07-08",
"url": "https://alas.aws.amazon.com/AL2/ALAS2ECS-2026-131.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:22513-1 vom 2026-07-08",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027315.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:42852 vom 2026-07-21",
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:44622 vom 2026-07-23",
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:51033 vom 2026-08-06",
"url": "https://access.redhat.com/errata/RHSA-2026:51033"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:51057 vom 2026-08-06",
"url": "https://access.redhat.com/errata/RHSA-2026:51057"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:53530 vom 2026-08-11",
"url": "https://access.redhat.com/errata/RHSA-2026:53530"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:21551-1 vom 2026-08-12",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/U3Y5I25TBZPPWBQLNS6WIFTXT7XXYJ7A/"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:54392 vom 2026-08-13",
"url": "https://access.redhat.com/errata/RHSA-2026:54392"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:54577 vom 2026-08-13",
"url": "https://access.redhat.com/errata/RHSA-2026:54577"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-6443 vom 2026-08-16",
"url": "https://security-tracker.debian.org/tracker/DSA-6443-1"
},
{
"category": "external",
"summary": "PoC CVE-2026-41567 vom 2026-08-20",
"url": "https://github.com/berdav/CVE-2026-41567"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2026-385 vom 2026-08-31",
"url": "https://www.dell.com/support/kbdoc/de-de/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2026-386 vom 2026-09-01",
"url": "https://www.dell.com/support/kbdoc/000503504/dsa-2026-386-security-update-f"
}
],
"source_lang": "en-US",
"title": "docker: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-08-31T22:00:00.000+00:00",
"generator": {
"date": "2026-09-01T10:52:38.639+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-1584",
"initial_release_date": "2026-05-18T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-05-18T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-06-04T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2026-34779"
},
{
"date": "2026-06-08T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2026-06-14T22:00:00.000+00:00",
"number": "4",
"summary": "Referenz(en) aufgenommen: EUVD-2026-36528, EUVD-2026-36527"
},
{
"date": "2026-06-18T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von IBM aufgenommen"
},
{
"date": "2026-06-23T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2026-06-29T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-06-30T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-07-01T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-07-02T22:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2026-07-05T22:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-07-07T22:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2026-07-08T22:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-07-21T22:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-07-23T22:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-05T22:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-06T22:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-11T22:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-12T22:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von openSUSE und Red Hat aufgenommen"
},
{
"date": "2026-08-13T22:00:00.000+00:00",
"number": "20",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-08-16T22:00:00.000+00:00",
"number": "21",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2026-08-20T22:00:00.000+00:00",
"number": "22",
"summary": "PoC f\u00fcr CVE-2026-41567 aufgenommen"
},
{
"date": "2026-08-31T22:00:00.000+00:00",
"number": "23",
"summary": "Neue Updates von Dell aufgenommen"
}
],
"status": "final",
"version": "23"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c5.36.00.16",
"product": {
"name": "Dell Secure Connect Gateway \u003c5.36.00.16",
"product_id": "T058878"
}
},
{
"category": "product_version",
"name": "5.36.00.16",
"product": {
"name": "Dell Secure Connect Gateway 5.36.00.16",
"product_id": "T058878-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:dell:secure_connect_gateway:5.36.00.16"
}
}
}
],
"category": "product_name",
"name": "Secure Connect Gateway"
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "operator",
"product": {
"name": "IBM MQ operator",
"product_id": "T036688",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:mq:operator"
}
}
}
],
"category": "product_name",
"name": "MQ"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c29.5.1",
"product": {
"name": "Open Source docker \u003c29.5.1",
"product_id": "T054310"
}
},
{
"category": "product_version",
"name": "29.5.1",
"product": {
"name": "Open Source docker 29.5.1",
"product_id": "T054310-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:docker:docker:29.5.1"
}
}
}
],
"category": "product_name",
"name": "docker"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
},
{
"category": "product_name",
"name": "SUSE openSUSE",
"product": {
"name": "SUSE openSUSE",
"product_id": "T027843",
"product_identification_helper": {
"cpe": "cpe:/o:suse:opensuse:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41567",
"product_status": {
"known_affected": [
"T054310",
"T058878",
"2951",
"T002207",
"67646",
"T027843",
"398363",
"T036688"
]
},
"release_date": "2026-05-18T22:00:00.000+00:00",
"title": "CVE-2026-41567"
},
{
"cve": "CVE-2026-41568",
"product_status": {
"known_affected": [
"T054310",
"T058878",
"2951",
"T002207",
"67646",
"T027843",
"398363",
"T036688"
]
},
"release_date": "2026-05-18T22:00:00.000+00:00",
"title": "CVE-2026-41568"
},
{
"cve": "CVE-2026-42306",
"product_status": {
"known_affected": [
"T054310",
"T058878",
"2951",
"T002207",
"67646",
"T027843",
"398363",
"T036688"
]
},
"release_date": "2026-05-18T22:00:00.000+00:00",
"title": "CVE-2026-42306"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…