Red Hat Security Advisory

RHSA-2026:18584

Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.9.4

Released 2026-05-19 · Red Hat rating Important · View on Red Hat →

Fixed in

multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8

Fixes 2 records

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248

TI-2026-06286 CVE-2026-7163 · GHSA-62pm-2jjw-mqpx

Cleartext storage of sensitive information in assisted-service

LOW 27

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obt…

CVSS 3.1MEDIUM 6.1 Adjacent network Low privileges User interaction EPSS 0.00194 Published 2026-04-30 Fixed in 2.7.10, 2.9.4 +8 CWE-312