RHSA-2026:92303HighCVSS 8.1

Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (13)

CVE-2026-56862 →CVE-2026-93748 →CVE-2026-106445 →CVE-2026-106446 →CVE-2026-33818 →CVE-2026-39822 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-63209 →CVE-2026-84304 →CVE-2026-39834 →CVE-2026-56858 →

📋 Description

CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-93748 — http-cache-semantics: http-cache-semantics: Information Disclosure via max-stale directive CVE-2026-106445 — handlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106446 — handlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)

🎯 Affected products109

  • multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:7b38ca05d2103f421c7254d560ee188cb3d10eaabb710efca8737ca367722506_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:84ddab463c7ccc043166d19b8203294590f64e3b7566cc0f9528cce352d51c10_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:af93687351f4acab9fd83a427f304317533ae5b4afb647dd679cb2c0d5bfa42d_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:f09238a7333bbf56e81e0c285e84d75f5e87d6a0445b382bdefb5127e3e706b7_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:2bb73ea848e1e649d0a3b02c26ea7dd5cb4884185057ee5c73fafaf9af945b32_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:38090f3afb296c06b97ce033d4202ac3cd54b5dfd1376e62e1f4046da2455b65_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:65aa3665ec4492789dd30efc65da53b304f32c64b21b84586588a591da89a7f3_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:89badb6f13b9f07fbfaea2f649d9337123199fddca17e23453e177715500f328_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:4628a5275621efd16458fa5558e89143c1588518f0c377dcba821b8cdf99f7fc_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:649110653689a7706222a36ad304c8401f1c7bdecaed717f9fdf337a6dc2203b_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82096c3c66219de3c5736f2fe41dfeab19eee27bbd14e1ac02c267a7af4d9423_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:acc25d5805f0ba029417a63864030bb3719bd494b2234215a6f6c74515185302_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:08226e450949200be8f7d33af1ab0864fc5c689518c043a69c9796d080d80a9a_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:09ca99ccf3d07db72fa24572a514640d01206aa78c3ca1f561e162f2e531ba05_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:5689e9a3d8b3ab29177a8b46314a6007eca313b5619a6fcc16b13f23bff0a7fc_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:98a3359ee796879355018a7a1d514ed7e501d9af43813d671dc9495607a0c9c0_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3527af6c4f146d02f90c5e3486406509203a46823d32a4994ca1633002b0febb_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:3adc9d294231bb80ccd931dc4ba39e12e30ce4957440dac27ca2d9e44f93e1e8_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:61c3751d9fc3d9d29a900f7bb6cdcf63547b2716fbac774663f2f94184f745ea_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:c327b977d9941d2adfd78ade0efeafc935515c3eb3ea69b37464a5f623630743_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:5453fc3bf03e88dd106f44027747a92c5365e8813624e6d805a753785a700c32_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:609627b388d2e88f9540c961eaa0c90205f9d7255237aa82440ce3ba1c325d26_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:6fd6a37c25d14f7ee243601609dc3624381a59836103313ecdf59c48f86c952e_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:f79755ffff4023218472c3210312571319b4017849776e0a72fcfe0a98675667_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:268829f91d00c708eb3ced08ff294b232bf9067b5e04c72b0acdc51220ba3273_amd64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:51dbf2658eaa73cc9ab60c36dfb4e09c6b9ca000415689077e051e5aeba91ba7_ppc64le as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:a506082006671e6657298dc71ef096570b4195a019f9df67d9648276dd0b3eb0_s390x as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:d4609e4bf467bef7d5a3a054b35c5c372552d02a1abaef290253b570806bdc1f_arm64 as a component of multicluster engine for Kubernetes 2.8
  • registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:5d179415478668eb8ff4233a67513e1ec2b48c934f74093863405245f7d07274_amd64 as a component of multicluster engine for Kubernetes 2.8
  • +79 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: Do not set allowProtoMethodsByDefault to true when compiling or rendering untrusted templates or untrusted data. Workaround: Upgrade to Handlebars 4.7.10 or later. Ensure only strings are passed to Handlebars.compile() and Handlebars.precompile(); reject non-string inputs. If templates are precompiled at build time, prefer the runtime-only build (handlebars/runtime) so compile() is unavailable on the server.

🔗 References (16)