TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx
form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)
Priority HIGH 77
form-data is a library for creating readable multipart/form-data streams.
RHSA-2026:60391
Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
Released 2026-08-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
Fixes 41 records
TI-2026-40198 CVE-2026-55677 · GHSA-vfp3-v2gw-7wfq
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Priority HIGH 72
Echo is a Go web framework.
TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
TI-2026-47440 CVE-2026-66800 · GHSA-hjp2-pvfv-h8vh
Azure Data Factory Information Disclosure Vulnerability
Priority MEDIUM 45
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
TI-2026-50788 CVE-2026-72526 · GHSA-hp26-rmxw-4cpv
Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub…
Priority MEDIUM 44
A flaw was found in the multicloud-integrations component.
TI-2026-50784 CVE-2026-72508 · GHSA-hr6f-38vx-3c48
Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke…
Priority MEDIUM 44
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).
TI-2026-49269 CVE-2026-70496 · GHSA-xg68-vc28-3f79
Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent…
Priority MEDIUM 44
A flaw was found in search-v2-operator.
TI-2026-47742 CVE-2026-67567 · GHSA-gf3r-gm67-jgrv
Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart…
Priority MEDIUM 44
A flaw was found in the multicloud-operators-subscription component.
TI-2026-47444 CVE-2026-66805 · GHSA-w35v-hpfj-gw86
Microsoft SharePoint Server Remote Code Execution Vulnerability
Priority MEDIUM 44
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
TI-2026-47433 CVE-2026-66792 · GHSA-8jj2-p7p7-6mr3
Incorrect authorization in Red Hat Multicluster Global Hub 1.4.9
Priority MEDIUM 44
A flaw was found in the multicloud-operators-subscription component.
TI-2026-50087 CVE-2026-71472 · GHSA-gqg9-92w2-w94m
Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem
Priority MEDIUM 43
A flaw was found in acm-search-v2-rhel9.
TI-2026-49184 CVE-2026-70398 · GHSA-cjw2-r57r-pwvf
Multicloud-integrations: multicloud-integrations…
Priority MEDIUM 43
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM).
TI-2026-50085 CVE-2026-71470 · GHSA-5g3m-2273-p6x6
Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow…
Priority MEDIUM 42
A flaw was found in the search-v2-operator.
TI-2026-47434 CVE-2026-66793 · GHSA-xh6j-xcjj-j38g
Improper input validation in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority MEDIUM 42
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes.
TI-2026-08844 CVE-2026-10090 · GHSA-g9vp-wj77-5767
Multicluster-operators-subscription: multicluster-operators-subscription: namespace edit…
Priority MEDIUM 42
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM).
TI-2026-50086 CVE-2026-71471 · GHSA-j9xr-mxxr-3948
Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated…
Priority MEDIUM 41
A flaw was found in acm-search-v2-rhel9.
TI-2026-50084 CVE-2026-71469 · GHSA-6gx2-rqm4-38f9
Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos
Priority MEDIUM 40
A flaw was found in search-v2-api.
TI-2026-34259 CVE-2026-46600 · GHSA-gg3m-vvp2-p2c5
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Priority MEDIUM 40
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
TI-2026-49268 CVE-2026-70495 · GHSA-q7g5-25j5-rf23
Improper privilege management in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 39
A flaw was found in search-v2-operator.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-34805 CVE-2026-47219 · GHSA-c96f-x56v-gq3h
find-my-way is Vulnerable to DDoS with HTTP2
Priority LOW 39
find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parameters and wildcards.
TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj
Prometheus Azure AD remote write OAuth client secret exposed via config API
Priority LOW 39
Prometheus is an open-source monitoring system and time series database.
TI-2026-50088 CVE-2026-71473 · GHSA-mm7v-f498-mqrj
Mass assignment in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 37
A flaw was found in the `search-v2-operator` component.
TI-2026-51303 CVE-2026-73137 · GHSA-rf6j-x765-j4p2
Information disclosure in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 34
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM).
TI-2026-51300 CVE-2026-73122 · GHSA-5rf6-jwvg-8r55
Improper privilege management in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 34
A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM).
TI-2026-50174 CVE-2026-71845 · GHSA-h2jx-ffv3-pwqm
Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()
Priority LOW 34
A flaw was found in insights-client.
TI-2026-47466 CVE-2026-66878 · GHSA-37c6-v768-8x6w
Authorization bypass in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 34
A flaw was found in multicloud-operators-subscription.
TI-2026-53667 CVE-2026-76827 · GHSA-4vrw-8fx2-pj82
Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)
Priority LOW 31
A flaw was found in search-indexer.
TI-2026-50090 CVE-2026-71475 · GHSA-gqvx-3g3q-49g9
Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path
Priority LOW 31
A flaw was found in insights-client.
TI-2026-50089 CVE-2026-71474 · GHSA-6q5x-r3rm-rpv8
Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
Priority LOW 30
A flaw was found in insights-client.
TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r
Inefficient candidate hostname parsing in crypto/x509
Priority LOW 30
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.
TI-2026-50175 CVE-2026-71846 · GHSA-wfwr-qqxc-6cch
Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege
Priority LOW 28
A flaw was found in insights-client.
TI-2026-46417 CVE-2026-64927 · GHSA-crwr-8cwh-w292
Authorization bypass in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 28
A flaw was found in the multicloud-operators-channel component.
TI-2026-15443 CVE-2026-18874 · GHSA-9w6h-ch94-8j27
Code injection in Red Hat Advanced Cluster Management for Kubernetes 2.11
Priority LOW 28
A flaw was found in volsync-addon-controller.
TI-2026-30785 CVE-2026-42502 · GHSA-wrh2-89vg-4j9g
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Priority LOW 27
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.
TI-2026-47437 CVE-2026-66797 · GHSA-6777-p72p-347g
Apache CloudStack: Unauthorised comment creation and disclosure
Priority LOW 25
Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.
TI-2026-47426 CVE-2026-66781 · GHSA-gcch-g8g2-6852
Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
Priority LOW 25
A flaw was found in the Submariner operator.
TI-2026-52869 CVE-2026-75485 · GHSA-28f5-gvgw-386q
Must-gather: /tmp/kubeconfig retention
Priority LOW 24
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.
TI-2026-51861 CVE-2026-73834 · GHSA-8m45-79jm-xw59
Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction
Priority LOW 24
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes.
TI-2026-50083 CVE-2026-71468 · GHSA-wg82-w434-qwgq
Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federation-config cache
Priority LOW 24
A flaw was found in acm-search-v2-api-rhel9.
TI-2026-47438 CVE-2026-66798 · GHSA-c27v-65fh-7pg2
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Priority LOW 23
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.