Red Hat Security Advisory

RHSA-2025:19961

Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update

Released 2025-11-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.12 registry.redhat.io/rhacm2/acm-cluster-permission-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9 +6

TI-2025-36412 CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01196 Published 2025-09-12 Partial fix · 1.12.0, 0.30.2 CWE-770

TI-2025-33491 CVE-2025-53547 · GHSA-557j-xg8c-q2mm

MEDIUM 40

Helm is a package manager for Charts for Kubernetes.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00494 Published 2025-07-08 Partial fix · 3.18.4, 3.17.4 CWE-94

TI-2025-30311 CVE-2025-47907 · GHSA-j5pm-7495-qmr3

LOW 31

Cancelling a query (e.g.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00406 Published 2025-08-07 Partial fix · 1.23.12, 1.24.6 CWE-362

TI-2025-06557 CVE-2025-7195 · GHSA-856v-8qm2-9wjv

LOW 28

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.

CVSS 3.1MEDIUM 6.4 Local High privileges No interaction EPSS 0.00243 Published 2025-08-07 Partial fix · 0.15.2, v4.17.39-2 +119 CWE-276