Vulnerability-Lookup

RHSA-2026:37252

Vulnerability from csaf_redhat - Published: 2026-07-09 11:05 - Updated: 2026-07-22 16:51

Summary

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4

Severity

Important

Notes

Topic: Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.10.4 General Availability release, with updates to container images.

Details: Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.10.4 release that simplify the process of deploying OpenShift Container Platform clusters. The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters, or to import existing Kubernetes-based clusters for management. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-53488

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected products

Fixed 8 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64	—	Vendor Fix fix Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le	—	Vendor Fix fix Workaround

Known not affected 12 products

Product	Version	Remediation
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x	—	Workaround
Unresolved product id: multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64	—	Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:37252	self
https://access.redhat.com/security/cve/CVE-2026-53488	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-53488	self
https://bugzilla.redhat.com/show_bug.cgi?id=2495815	external
https://www.cve.org/CVERecord?id=CVE-2026-53488	external
https://nvd.nist.gov/vuln/detail/CVE-2026-53488	external
https://github.com/containerd/containerd/security…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.10.4 General Availability release, with updates to container images.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Assisted Installer RHEL 9 integrates components for the general multicluster engine\nfor Kubernetes 2.10.4 release that simplify the process of deploying OpenShift Container\nPlatform clusters.\n\nThe multicluster engine for Kubernetes provides the foundational components\nthat are necessary for the centralized management of multiple\nKubernetes-based clusters across data centers, public clouds, and private\nclouds.\n\nYou can use the engine to create new Red Hat OpenShift Container Platform\nclusters, or to import existing Kubernetes-based clusters for management.\n\nAfter the clusters are managed, you can use the APIs that\nare provided by the engine to distribute configuration based on placement\npolicy.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:37252",
        "url": "https://access.redhat.com/errata/RHSA-2026:37252"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-53488",
        "url": "https://access.redhat.com/security/cve/CVE-2026-53488"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37252.json"
      }
    ],
    "title": "Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4",
    "tracking": {
      "current_release_date": "2026-07-22T16:51:35+00:00",
      "generator": {
        "date": "2026-07-22T16:51:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:37252",
      "initial_release_date": "2026-07-09T11:05:36+00:00",
      "revision_history": [
        {
          "date": "2026-07-09T11:05:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-18T05:32:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-22T16:51:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "multicluster engine for Kubernetes 2.1",
                "product": {
                  "name": "multicluster engine for Kubernetes 2.1",
                  "product_id": "multicluster engine for Kubernetes 2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:multicluster_engine:2.10::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "multicluster engine for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-image-service-rhel9\u0026tag=1783592985"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3Aa25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-rhel9\u0026tag=1783592595"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3Ae41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9\u0026tag=1783592566"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3Ad4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9\u0026tag=1783592450"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3A770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-service-9-rhel9\u0026tag=1783350355"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-image-service-rhel9\u0026tag=1783592985"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-rhel9\u0026tag=1783592595"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3Ac01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9\u0026tag=1783592566"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3A3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9\u0026tag=1783592450"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3A942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-service-9-rhel9\u0026tag=1783350355"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-image-service-rhel9\u0026tag=1783592985"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-rhel9\u0026tag=1783592595"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3A581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9\u0026tag=1783592566"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3A3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9\u0026tag=1783592450"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3A9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-service-9-rhel9\u0026tag=1783350355"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-image-service-rhel9\u0026tag=1783592985"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-rhel9\u0026tag=1783592595"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3A074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9\u0026tag=1783592566"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3Ae7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9\u0026tag=1783592450"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3A7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine/assisted-service-9-rhel9\u0026tag=1783350355"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64 as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le as a component of multicluster engine for Kubernetes 2.1",
          "product_id": "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-53488",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-07-01T02:01:09.589815+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2495815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversight could enable an attacker to execute arbitrary commands on the host system through a plugin that processes these unvalidated labels. The primary impact is host-root command execution, allowing unauthorized control over the underlying system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in containerd where the CRI plugin propagates labels from an image configuration (LABEL instruction in a Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host via a plugin that consumes container labels for operations, such as the restart-monitor binary:// logger. An attacker who can cause a crafted container image to be pulled and run can achieve host-level code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le"
        ],
        "known_not_affected": [
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
          "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-53488"
        },
        {
          "category": "external",
          "summary": "RHBZ#2495815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-53488",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53488"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53488"
        },
        {
          "category": "external",
          "summary": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
        }
      ],
      "release_date": "2026-07-01T00:11:20.610000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-09T11:05:36+00:00",
          "details": "For more information about Assisted Installer, see the following documentation:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#cim-intro\n\nFor multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro\n\nThis documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.15.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:37252"
        },
        {
          "category": "workaround",
          "details": "Restrict container image pulls to trusted registries using admission policies or image signature verification. Where containerd is used as the container runtime, disable or restrict the binary:// logger URI scheme in the containerd configuration to prevent the label-to-logger attack path.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:1edfe7d3c137b3841a4f0094381568a3c72ff8586c0366f5d19952d46c6f107b_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:341cf8d78c8a0d24c342349e8626d9374d88abec2f39c8eed84f3468c492bbaf_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:3c62f61ec91569d9710a5bdfea1083bf3ef8b1e33f0b37a6e7ce03632d1c1801_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:9467ff2f5ff584b3280404751725555f3f66970d768fcd813612059927f2da91_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:074851f640d7c043b8b98a8e91383a800faeabadc593a712ee0690c7a6ce8171_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:581bfffc3160d6a6a0e87f1814546b0f083c9d704707d54fb45940ad5e651e5d_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:c01c5936a378bb2bab77688e9d78f38db76b5b2fba1266757f840a3431343983_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:e41150198d82aa1745d6718823f6645f28a8c307a5a4afe6c04edb09f63b5301_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3528bbf836e17a2cde26879924b236d821f3ed4e7ebc29ae98d2c25f10f5c24a_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:3d62eafa1eec909dc29c3086465fe7db75ce0c47c5e5c07740d58ae1e0c7c680_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d4655d031c52220d7f044108d164eeb8f82a7b97eb22ff63bec0427f6b498126_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:e7aa6c75b27508998667bcb8ef5240834eee92876157e3343699b6c3f8abb63f_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:05e966520b3ce2f7d0bded29f47d9102f8b6881f5de0cff8808997e22fd319d8_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:3488166775a8a52a8e363cdba4f1f7a85d0edf243179bba574d09803671180cd_ppc64le",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:66a1919295f38c9cb734ceccf58aae27489d7bd209de21cd97cbc26e5c3e9e10_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:a25d2740613b2e9c60e8e16f21b235340abab3276da63affe0f6edb5795b5012_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:7589cbb724b5a95bfc09efe2a25ec1be9812c2184d77d286be134df33674be60_s390x",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:770f93db9c01d084f8bad1ea59ea19df7c0e467c19f8b12a455551449c2a55ad_amd64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:942091cc19cadf1d9c89c5d3664c71d218eadc153dd14ea3e77785e7ee617e03_arm64",
            "multicluster engine for Kubernetes 2.1:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:9c1a5a965c26be89060883bd3bf50bc85a39b5e39dd090320860aad4b1d925f0_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin"
    }
  ]
}

CVE-2026-53488 (GCVE-0-2026-53488)

Vulnerability from cvelistv5 – Published: 2026-07-01 00:11 – Updated: 2026-07-03 03:56

Title

containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull

Summary

containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/containerd/containerd/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
containerd	containerd	Affected: < 1.7.33 Affected: >= 2.0.0, < 2.0.10 Affected: >= 2.1.0, < 2.1.9 Affected: >= 2.2.0, < 2.2.5 Affected: >= 2.3.0, < 2.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53488",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-03T03:56:07.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containerd",
          "vendor": "containerd",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.7.33"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.0.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.1.0, \u003c 2.1.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.2.0, \u003c 2.2.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T00:11:20.610Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"
        }
      ],
      "source": {
        "advisory": "GHSA-xhf5-7wjv-pqxp",
        "discovery": "UNKNOWN"
      },
      "title": "containerd CRI plugin: \u2014 image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53488",
    "datePublished": "2026-07-01T00:11:20.610Z",
    "dateReserved": "2026-06-09T17:05:25.059Z",
    "dateUpdated": "2026-07-03T03:56:07.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

RHSA-2026:37252

CVE-2026-53488 (GCVE-0-2026-53488)

Tags

Sightings

Nomenclature