Red Hat Security AdvisoryRHSA-2026:8218
multicluster engine for Kubernetes v2.8.5 security update
Released 2026-04-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +5
Fixes 10 records
Priority MEDIUM 51
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00902 · Published 2026-02-05 · Partial fix · 1.24.13, 1.25.7 +1 CWE-295
Priority MEDIUM 46
Immutable.js provides many Persistent Immutable data structures.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-03-06 · Partial fix · 3.8.3, 4.3.7 +2 CWE-1321
Priority MEDIUM 44
Axios is a promise based HTTP client for the browser and Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02759 · Published 2026-02-09 · Partial fix · 1.13.5, 0.30.3 CWE-754
Priority MEDIUM 43
The net/url package does not set a limit on the number of query parameters in a query.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02292 · Published 2026-01-28 · Partial fix · 1.24.12, 1.25.6 CWE-770
Priority MEDIUM 40
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.01823 · Published 2026-01-21 · Partial fix · 4.17.23, 4.18.0 CWE-1321
Priority LOW 38
React Router is a router for React.
CVSS 3.1HIGH 8.0· Network · No auth · User interaction · EPSS 0.00866 · Published 2026-01-10 · Partial fix · 7.12.0, 1.23.2 CWE-79
Priority LOW 37
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM).
CVSS 3.1HIGH 8.2· Local · High privileges · No interaction · EPSS 0.00151 · Published 2026-04-07 · Partial fix · 1776881164, 1777478390 +4 CWE-295
Priority LOW 33
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0049 · Published 2025-12-02 · Partial fix · 1.24.11, 1.25.5 CWE-295
Priority LOW 31
Cancelling a query (e.g.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00406 · Published 2025-08-07 · Partial fix · 1.23.12, 1.24.6 CWE-362
Priority LOW 20
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00443 · Published 2025-10-29 · Partial fix · 1.24.8, 1.25.2
THREATIST.IORead the docs