Red Hat Security Advisory

RHSA-2026:67539

Red Hat Advanced Cluster Management for Kubernetes v2.14.5 security update

Released 2026-09-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7

Fixes 11 records

TI-2026-42693 CVE-2026-59879 · GHSA-v56q-mh7h-f735

Immutable.js `List` 32-bit trie overflow → unrecoverable DoS

HIGH 77

Immutable.js provides many Persistent Immutable data structures.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00575 Published 2026-07-08 Partial fix · 5.1.8, 4.3.9 +1 CWE-1284

TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

MEDIUM 63

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-06-04 Partial fix · 1.42.0, 1.44.0 CWE-789

TI-2026-40371 CVE-2026-55969 · GHSA-x8jh-qfcv-fp29

Integer overflow in Apache Thrift

MEDIUM 46

Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-190

TI-2026-35942 CVE-2026-48586 · GHSA-6h9h-5c4r-fqgf

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift…

MEDIUM 46

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0103 Published 2026-07-27 Partial fix · 0.24.0 CWE-409

TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm

Prometheus: remote read endpoint allows denial of service via crafted snappy payload

MEDIUM 40

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00813 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +2 CWE-400

TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835

TI-2026-60358 CVE-2026-89060 · GHSA-39w5-9x42-rwmr

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in…

LOW 34

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryColl…

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00475 Published 2026-09-11 Fixed in 1789126264, 1789126262 +1 CWE-551

TI-2026-25776 CVE-2026-33377 · GHSA-5cv7-h7gr-wjgh

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

LOW 33

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00226 Published 2026-05-13 Partial fix · 11.6.14+security-04, 12.2.8+security-04 +3 CWE-284

TI-2026-47425 CVE-2026-66780 · GHSA-3xmh-phwc-5f4g