TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:59556
multicluster engine for Kubernetes v2.11.6 security update
Released 2026-08-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +14
Fixes 14 records
TI-2026-47435 CVE-2026-66794 · GHSA-9855-9cch-x8mw
Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
Priority MEDIUM 47
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes.
TI-2026-51403 CVE-2026-73269 · GHSA-h2w9-5qx3-frqq
Improper privilege management in Red Hat multicluster engine for Kubernetes 2.10
Priority MEDIUM 44
A flaw was found in the cluster-curator-controller component.
TI-2026-51402 CVE-2026-73268 · GHSA-6c6p-j4gf-mj2c
Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
Priority MEDIUM 44
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE).
TI-2026-47436 CVE-2026-66795 · GHSA-w9c6-w29v-4vp6
Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.10
Priority MEDIUM 43
A flaw was found in the managedcluster-import-controller.
TI-2026-08816 CVE-2026-10059 · GHSA-f7c4-3r82-969w
Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to…
Priority MEDIUM 42
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller.
TI-2026-51401 CVE-2026-73267 · GHSA-q3cg-8r2r-6g4g
Clusterclaims-controller: managedcluster deletion keyed solely on…
Priority LOW 35
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE).
TI-2026-51400 CVE-2026-73266 · GHSA-xp42-v53j-r9gh
Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels…
Priority LOW 31
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE).
TI-2026-30790 CVE-2026-42507 · GHSA-h3gm-q7m7-mp28
Arbitrary inputs are included in errors without any escaping in net/textproto
Priority LOW 30
When returning errors, functions in the net/textproto package would include its input as part of the error.
TI-2026-28707 CVE-2026-39825 · GHSA-h74g-238j-357m
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
Priority LOW 30
ReverseProxy can forward queries containing parameters not visible to Rewrite functions.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
TI-2024-30406 CVE-2024-45336 · GHSA-7wrw-r4p8-38rx
Sensitive headers incorrectly sent after cross-domain redirect in net/http
Priority LOW 28
The HTTP client drops sensitive headers after following a cross-domain redirect.
TI-2026-15620 CVE-2026-19130 · GHSA-3vwx-g7ch-f3wg
Authorization bypass in Red Hat multicluster engine for Kubernetes 2.10
Priority LOW 26
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE).
TI-2025-16738 CVE-2025-22866 · GHSA-3whm-j4xm-rv8x
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Priority LOW 19
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture.