Vulnerability-Lookup

RHSA-2026:67842

Vulnerability from csaf_redhat - Published: 2026-09-16 06:27 - Updated: 2026-09-22 13:02

Summary

Red Hat Security Advisory: Multicluster Global Hub 1.7.3 security update

Severity

Important

Notes

Topic: Multicluster Global Hub v1.7.3 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-32282

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64	—	Workaround

Threats

Impact Moderate

CVE-2026-33815

A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE-787 - Out-of-bounds Write

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Important

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64		—

Threats

Impact Important

CVE-2026-34040

A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system's integrity and confidentiality.

8.4 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Moderate

CVE-2026-46604

A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leading to the unavailability of the affected system.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Moderate

CVE-2026-48586

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Important

CVE-2026-50151

A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller's credentials, leading to information disclosure. Additionally, it can enable client-side Server-Side Request Forgery (SSRF) to a cross-host target.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-522 - Insufficiently Protected Credentials

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Moderate

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-71235

A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

CWE-345 - Insufficient Verification of Data Authenticity

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64	—	Workaround

Threats

Impact Important

CVE-2026-71577

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-522 - Insufficiently Protected Credentials

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x	—	Workaround

Threats

Impact Moderate

CVE-2026-75762

No description is available for this CVE.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

CWE-290 - Authentication Bypass by Spoofing

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64	—	Vendor Fix fix

Known not affected 9 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x		—

Threats

Impact Important

CVE-2026-77849

No description is available for this CVE.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-798 - Use of Hard-coded Credentials

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Important

CVE-2026-79921

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Important

CVE-2026-80220

No description is available for this CVE.

5.4 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64		—
Unresolved product id: Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64		—

Threats

Impact Important

CVE-2026-80221

No description is available for this CVE.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-312 - Cleartext Storage of Sensitive Information

Affected products

Fixed 4 products, the same list as for CVE-2026-32282

Known not affected 17 products, the same list as for CVE-2026-32282

Threats

Impact Important

References

146 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:67842	self
https://access.redhat.com/security/cve/CVE-2026-32282	external
https://access.redhat.com/security/cve/CVE-2026-33815	external
https://access.redhat.com/security/cve/CVE-2026-33818	external
https://access.redhat.com/security/cve/CVE-2026-34040	external
https://access.redhat.com/security/cve/CVE-2026-46604	external
https://access.redhat.com/security/cve/CVE-2026-48586	external
https://access.redhat.com/security/cve/CVE-2026-50151	external
https://access.redhat.com/security/cve/CVE-2026-56852	external
https://access.redhat.com/security/cve/CVE-2026-56853	external
https://access.redhat.com/security/cve/CVE-2026-56858	external
https://access.redhat.com/security/cve/CVE-2026-56859	external
https://access.redhat.com/security/cve/CVE-2026-56860	external
https://access.redhat.com/security/cve/CVE-2026-56862	external
https://access.redhat.com/security/cve/CVE-2026-71235	external
https://access.redhat.com/security/cve/CVE-2026-71576	external
https://access.redhat.com/security/cve/CVE-2026-71577	external
https://access.redhat.com/security/cve/CVE-2026-75762	external
https://access.redhat.com/security/cve/CVE-2026-77849	external
https://access.redhat.com/security/cve/CVE-2026-79921	external
https://access.redhat.com/security/cve/CVE-2026-80220	external
https://access.redhat.com/security/cve/CVE-2026-80221	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-32282	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456336	external
https://www.cve.org/CVERecord?id=CVE-2026-32282	external
https://nvd.nist.gov/vuln/detail/CVE-2026-32282	external
https://go.dev/cl/763761	external
https://go.dev/issue/78293	external
https://groups.google.com/g/golang-announce/c/0uY…	external
https://pkg.go.dev/vuln/GO-2026-4864	external
https://access.redhat.com/security/cve/CVE-2026-33815	self
https://bugzilla.redhat.com/show_bug.cgi?id=2455975	external
https://www.cve.org/CVERecord?id=CVE-2026-33815	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33815	external
https://pkg.go.dev/vuln/GO-2026-4771	external
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-34040	self
https://bugzilla.redhat.com/show_bug.cgi?id=2453278	external
https://www.cve.org/CVERecord?id=CVE-2026-34040	external
https://nvd.nist.gov/vuln/detail/CVE-2026-34040	external
https://github.com/moby/moby/releases/tag/docker-…	external
https://github.com/moby/moby/security/advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-46604	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493766	external
https://www.cve.org/CVERecord?id=CVE-2026-46604	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46604	external
https://go.dev/cl/788421	external
https://go.dev/issue/80122	external
https://pkg.go.dev/vuln/GO-2026-5066	external
https://access.redhat.com/security/cve/CVE-2026-48586	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507434	external
https://www.cve.org/CVERecord?id=CVE-2026-48586	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48586	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/7v3jhgwfbmhx42424…	external
https://lists.apache.org/thread/p008svsjf9p6bj47w…	external
https://access.redhat.com/security/cve/CVE-2026-50151	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499693	external
https://www.cve.org/CVERecord?id=CVE-2026-50151	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50151	external
https://github.com/oras-project/oras-go/security/…	external
https://access.redhat.com/security/cve/CVE-2026-56852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233	external
https://www.cve.org/CVERecord?id=CVE-2026-56852	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852	external
https://go.dev/cl/794100	external
https://go.dev/issue/80142	external
https://pkg.go.dev/vuln/GO-2026-5970	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-71235	self
https://www.cve.org/CVERecord?id=CVE-2026-71235	external
https://access.redhat.com/security/cve/CVE-2026-71576	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512513	external
https://www.cve.org/CVERecord?id=CVE-2026-71576	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71576	external
https://access.redhat.com/security/cve/CVE-2026-71577	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512514	external
https://www.cve.org/CVERecord?id=CVE-2026-71577	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71577	external
https://access.redhat.com/security/cve/CVE-2026-75762	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518375	external
https://www.cve.org/CVERecord?id=CVE-2026-75762	external
https://nvd.nist.gov/vuln/detail/CVE-2026-75762	external
https://access.redhat.com/security/cve/CVE-2026-77849	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518332	external
https://www.cve.org/CVERecord?id=CVE-2026-77849	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77849	external
https://access.redhat.com/security/cve/CVE-2026-79921	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524713	external
https://www.cve.org/CVERecord?id=CVE-2026-79921	external
https://nvd.nist.gov/vuln/detail/CVE-2026-79921	external
https://github.com/rabbitmq/amqp091-go/commit/6be…	external
https://github.com/rabbitmq/amqp091-go/pull/353	external
https://github.com/rabbitmq/amqp091-go/releases/t…	external
https://github.com/rabbitmq/amqp091-go/security/a…	external
https://access.redhat.com/security/cve/CVE-2026-80220	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518396	external
https://www.cve.org/CVERecord?id=CVE-2026-80220	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80220	external
https://access.redhat.com/security/cve/CVE-2026-80221	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518333	external
https://www.cve.org/CVERecord?id=CVE-2026-80221	external
https://nvd.nist.gov/vuln/detail/CVE-2026-80221	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multicluster Global Hub v1.7.3 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:67842",
        "url": "https://access.redhat.com/errata/RHSA-2026:67842"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33815",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33815"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34040",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34040"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46604",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46604"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48586",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-50151",
        "url": "https://access.redhat.com/security/cve/CVE-2026-50151"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71235",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71235"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71576",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71576"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71577",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71577"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75762",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75762"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77849",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77849"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79921",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80220",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80220"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67842.json"
      }
    ],
    "title": "Red Hat Security Advisory: Multicluster Global Hub 1.7.3 security update",
    "tracking": {
      "current_release_date": "2026-09-22T13:02:27+00:00",
      "generator": {
        "date": "2026-09-22T13:02:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:67842",
      "initial_release_date": "2026-09-16T06:27:36+00:00",
      "revision_history": [
        {
          "date": "2026-09-16T06:27:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-16T06:27:57+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-22T13:02:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Multicluster Global Hub 1.7.3",
                "product": {
                  "name": "Multicluster Global Hub 1.7.3",
                  "product_id": "Multicluster Global Hub 1.7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Multicluster Global Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Ad207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788376193"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Af4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788377473"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788377424"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1788503575"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Adf27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788372439"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ab1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200952"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Ae1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788376193"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Ab46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788377473"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788377424"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ae188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788372439"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Abfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200952"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788376193"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788377473"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aaf05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788377424"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788372439"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200952"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788376193"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Aecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788377473"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788377424"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788372439"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ac6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200952"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64 as a component of Multicluster Global Hub 1.7.3",
          "product_id": "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.7.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-32282",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-04-08T02:01:12.683211+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456336"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456336",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763761",
          "url": "https://go.dev/cl/763761"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78293",
          "url": "https://go.dev/issue/78293"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4864",
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "release_date": "2026-04-08T01:06:55.953000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
    },
    {
      "cve": "CVE-2026-33815",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-04-07T16:01:25.130006+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455975"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33815"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455975",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455975"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33815",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33815"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33815",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33815"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4771",
          "url": "https://pkg.go.dev/vuln/GO-2026-4771"
        }
      ],
      "release_date": "2026-04-07T15:19:24.344000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-34040",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-03-31T03:01:34.530713+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2453278"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system\u0027s integrity and confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Moby: Moby: Authorization bypass vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34040"
        },
        {
          "category": "external",
          "summary": "RHBZ#2453278",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453278"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34040",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34040"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
          "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
          "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"
        }
      ],
      "release_date": "2026-03-31T01:36:48.205000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Moby: Moby: Authorization bypass vulnerability"
    },
    {
      "cve": "CVE-2026-46604",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-06-26T21:05:50.463844+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leading to the unavailability of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the golang.org/x/image/tiff package. The TIFF decoder does not validate strip offsets read from a TIFF Image File Directory (IFD) before dereferencing them. Processing a specially crafted, invalid TIFF image with an out-of-bounds strip offset triggers a runtime panic, causing a denial of service in any application that decodes attacker-supplied TIFF images, such as thumbnail generators, document processors, or image upload handlers. Exploitation requires the application to decode a malicious TIFF file supplied by the attacker (CVSS UI:R); there is no impact to confidentiality or integrity, only availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46604",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46604",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/788421",
          "url": "https://go.dev/cl/788421"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80122",
          "url": "https://go.dev/issue/80122"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5066",
          "url": "https://pkg.go.dev/vuln/GO-2026-5066"
        }
      ],
      "release_date": "2026-06-26T20:22:46.377000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "There is no complete inline mitigation for this issue; the fix requires upgrading golang.org/x/image to version 0.43.0 or later, which validates the strip offset before use. Where an immediate upgrade is not possible, exposure can be reduced by not decoding untrusted or externally supplied TIFF images, or by isolating TIFF decoding in a sandboxed, restartable worker process so a panic does not crash the primary service.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image"
    },
    {
      "cve": "CVE-2026-48586",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-27T12:01:11.736259+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507434"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Thrift\u0027s handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507434",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/24/37",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
          "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq",
          "url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
        }
      ],
      "release_date": "2026-07-27T11:02:54.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data"
    },
    {
      "cve": "CVE-2026-50151",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2026-07-01T21:35:45+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499693"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller\u0027s credentials, leading to information disclosure. Additionally, it can enable client-side Server-Side Request Forgery (SSRF) to a cross-host target.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in oras-go. During monolithic blob upload, the Authorization header is reused for cross-host Location redirects, allowing a malicious registry to exfiltrate caller credentials.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499693",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499693"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7",
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
        }
      ],
      "release_date": "2026-07-01T21:35:45+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Upgrade to oras-go v2.6.1 or later.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-71235",
      "discovery_date": "2026-08-05T12:07:04.533964+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Magistrala\u0027s Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71235"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71235",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71235"
        }
      ],
      "release_date": "2026-08-05T10:56:25.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution"
    },
    {
      "cve": "CVE-2026-71576",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-08-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512513"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multicluster-global-hub: multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw where a compromised managed hub, possessing a valid Kafka client certificate, can impersonate other hubs within the Multicluster Global Hub environment. This allows an attacker to falsify or delete critical compliance, inventory, and cluster health data, leading to significant data integrity issues.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71576"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512513",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512513"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71576",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71576"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71576",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71576"
        }
      ],
      "release_date": "2026-08-10T14:38:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multicluster-global-hub: multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers"
    },
    {
      "cve": "CVE-2026-71577",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2026-08-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512514"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multicluster-global-hub: multicluster-global-hub: Spec-topic Read ACL leaks bootstrap kubeconfigs to all managed hubs during migration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in multicluster-global-hub allows a compromised managed hub to obtain a long-lived API server token for a target hub during a ManagedClusterMigration. This occurs because the operator grants broad read access to the shared Kafka topic and transmits bootstrap kubeconfigs with extended token validity in plaintext. Exploitation requires both a prior compromise of a managed hub and an active migration initiated by a global-hub administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71577"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512514",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512514"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71577"
        }
      ],
      "release_date": "2026-08-10T14:38:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "multicluster-global-hub: multicluster-global-hub: Spec-topic Read ACL leaks bootstrap kubeconfigs to all managed hubs during migration"
    },
    {
      "cve": "CVE-2026-75762",
      "cwe": {
        "id": "CWE-290",
        "name": "Authentication Bypass by Spoofing"
      },
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518375"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75762"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518375",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518375"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75762"
        }
      ],
      "release_date": "2026-08-31T13:49:12.863000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers"
    },
    {
      "cve": "CVE-2026-77849",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana-global-hub: grafana-global-hub: Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77849"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77849",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77849"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77849",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77849"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana-global-hub: grafana-global-hub: Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`"
    },
    {
      "cve": "CVE-2026-79921",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-26T21:01:49.454950+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524713"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the amqp091-go client can lead to a denial of service in Red Hat products. A compromised or malicious AMQP broker could exploit this by sending oversized payloads, forcing the client to consume excessive memory and potentially causing application-layer service disruption. The impact is considered Important due to the potential for resource exhaustion and disruption of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524713",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524713"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/353",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/353"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"
        }
      ],
      "release_date": "2026-08-26T20:24:58.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads"
    },
    {
      "cve": "CVE-2026-80220",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518396"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "postgres-exporter: postgres-exporter: pprof profiling endpoints exposed on unauthenticated metrics listener",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80220"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518396",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518396"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80220",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80220"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80220",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80220"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgres-exporter: postgres-exporter: pprof profiling endpoints exposed on unauthenticated metrics listener"
    },
    {
      "cve": "CVE-2026-80221",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518333"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana-global-hub: grafana-global-hub: Direct database connection string with embedded credentials passed as environment variable",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
          "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80221"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518333",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518333"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80221"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-16T06:27:36+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:11066fb9dd7c5eb0264356f94f647b21040be8afcbaaa6edde3f331f26df9ddb_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b46207d31581411bb23599249bed969d18d0cf1b307f4330c1ac7795cec45dbe_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ecff4e70310291b88bc9feea15ef398806134ac8702b168843333d082f626584_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:f4fcf5ebf61d34197552258d2fed70fe3ab6ceb0fe95a5cabe4d343356920d8b_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:5fa26d8fdf99b4d54a5873a677e6f49ee5e75ac5d54d3126fbafc6f3fd54150d_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8373764397a6f93efcc70e99be24d8ea9d4a8c2b56c943ad91ea7c8a6aff258c_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d207ab760660ed450de4158912a65063b014f5c27ca1f6a9b85f1fa74c7d1bfa_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:e1431b8e7defcc9143145c3ef393b6e28d417aae56f970581acbdb7d1ed87653_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:4ef6d30eae3bb4894056f2c64cf7999cc0ea6da3b95cb943d3f2af8e784a0b61_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:52378f145b71730fd00936117e7ca5b9759216748a0d453a70cd47606efb384c_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6b9ede59fdcb7f1756369929b3c83c362f30a8a7730d242ccd99d1ac08893881_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:af05905391a314b425086e819c7c5336b43a0695ae4cc4fd990a8c657a4a3dea_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:91be545e9c67fae82ec298439fa98da87d7add142b8d6e30751300a062ee0b35_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:32991c61ae06fdc8326e51920c15f77d340b2520d5c969d20c8406d709e075bc_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1c16ba311296baef2fb01c268e9e1c60131947aeefdb4ed5015c83e12c3e5fb_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:bfe69541ac625eccdbda310e82fa67dd555ac4b83265dfccd09dcf89efe24dae_arm64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c6bfc03ef8202743b1aab7115d10837d8e7ca19a32ac76f92b6a2e4b37836493_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:12b14d7e21b0ec1a23b04e8bf0f0a26371d831364631256d70f1115e6b668152_s390x",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2457ed4af69bb79ad0200723124be2be1fade8245f15974547b95215b1a84869_ppc64le",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:df27e324a758d914eab80dc0ab73d34c38c7c81fdc3884884737a252722ae6d8_amd64",
            "Multicluster Global Hub 1.7.3:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e188a4e40913230b8562f2d8bb7b06af4e486570eb5135ff812eaeea51b05511_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana-global-hub: grafana-global-hub: Direct database connection string with embedded credentials passed as environment variable"
    }
  ]
}

CVE-2026-32282 (GCVE-0-2026-32282)

Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:20

Title

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Summary

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-13 17:47 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/763761
https://go.dev/issue/78293
https://groups.google.com/g/golang-announce/c/0uY…
https://pkg.go.dev/vuln/GO-2026-4864

Impacted products

1 product

Vendor	Product	Version
Go standard library	internal/syscall/unix	Affected: 0 , < 1.25.9 (semver) Affected: 1.26.0-0 , < 1.26.2 (semver)

Credits

Uuganbayar Lkhamsuren (https://github.com/uug4na)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-32282",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-13T17:47:42.666766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-13T18:20:56.456Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "internal/syscall/unix",
          "platforms": [
            "linux"
          ],
          "product": "internal/syscall/unix",
          "programRoutines": [
            {
              "name": "Fchmodat"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.2",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Uuganbayar Lkhamsuren (https://github.com/uug4na)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T01:06:55.953Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/763761"
        },
        {
          "url": "https://go.dev/issue/78293"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4864"
        }
      ],
      "title": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-32282",
    "datePublished": "2026-04-08T01:06:55.953Z",
    "dateReserved": "2026-03-11T16:38:46.556Z",
    "dateUpdated": "2026-04-13T18:20:56.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33815 (GCVE-0-2026-33815)

Vulnerability from cvelistv5 – Published: 2026-04-07 15:19 – Updated: 2026-09-17 12:04

Title

CVE-2026-33815 in github.com/jackc/pgx

Summary

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-09 14:21 UTC

CWE

CWE-129 — Improper Validation of Array Index
CWE-787 - Out-of-bounds Write

Assigner

Go Google root

References

21 references

URL	Tags
https://pkg.go.dev/vuln/GO-2026-4771
https://access.redhat.com/security/cve/CVE-2026-33815	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2455975	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41019	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26636	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22423	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24503	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60388	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24539	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:25273	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11070	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:11217	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13791	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:13829	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40984	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24479	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24475	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:24482	vendor-advisoryx_refsource_REDHAT

Impacted products

57 products

Vendor	Product	Version
github.com/jackc/pgx/v5	github.com/jackc/pgx/v5/pgproto3	Affected: 0 , < 5.9.0 (semver)
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.2.0-13 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	RHEM 1.0 for RHEL 9	Unaffected: 0:1.0.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.0::el9
Red Hat	RHEM 1.1 for RHEL 10	Unaffected: 0:1.1.3-1.el10em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el10
Red Hat	RHEM 1.1 for RHEL 9	Unaffected: 0:1.1.3-1.el9em , < * (rpm) cpe:/a:redhat:edge_manager:1.1::el9
Red Hat	Custom Metric Autoscaler 2.19	Unaffected: 1780101236 , < * (rpm) cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9
Red Hat	Custom Metric Autoscaler 2.19	Unaffected: 1780101226 , < * (rpm) cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9
Red Hat	Custom Metric Autoscaler 2.19	Unaffected: 1780101239 , < * (rpm) cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9
Red Hat	Custom Metric Autoscaler 2.19	Unaffected: 1779953535 , < * (rpm) cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9
Red Hat	Multicluster Global Hub 1.3.4	Unaffected: 1779210675 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.3::el9
Red Hat	Multicluster Global Hub 1.3.4	Unaffected: 1779210608 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.3::el9
Red Hat	Multicluster Global Hub 1.3.4	Unaffected: 1779209992 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.3::el9
Red Hat	Multicluster Global Hub 1.7.0	Unaffected: 1779925273 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.14	Unaffected: 1787645355 , < * (rpm) cpe:/a:redhat:acm:2.14::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.15	Unaffected: 1780677003 , < * (rpm) cpe:/a:redhat:acm:2.15::el9
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2.16	Unaffected: 1780926805 , < * (rpm) cpe:/a:redhat:acm:2.16::el9
Red Hat	Red Hat Advanced Cluster Security 4.8	Unaffected: 1777307791 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.8::el8
Red Hat	Red Hat Advanced Cluster Security 4.9	Unaffected: 1777986630 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.9::el8
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	Unaffected: 1777976489 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.10::el8
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667125 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783666755 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784054598 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055387 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055726 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667517 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667577 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667611 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055020 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667641 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055586 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667790 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667859 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667875 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667869 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783667877 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055576 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055244 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1784055382 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783668266 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783668288 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1783669219 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Trusted Artifact Signer 1.3	Unaffected: 1780053572 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.3::el9
Red Hat	Red Hat Trusted Artifact Signer 1.3	Unaffected: 1780048814 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.3::el9
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Global Hub	cpe:/a:redhat:multicluster_globalhub
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat 3scale API Management Platform 2	cpe:/a:redhat:red_hat_3scale_amp:2
Red Hat	Red Hat Advanced Cluster Security 4	cpe:/a:redhat:advanced_cluster_security:4
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Trusted Artifact Signer	cpe:/a:redhat:trusted_artifact_signer:1
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33815",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T14:21:42.714758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T16:04:02.725Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.0 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.0.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el10"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el10em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "RHEM 1.1 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.1.3-1.el9em",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9",
            "product": "Custom Metric Autoscaler 2.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780101236",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9",
            "product": "Custom Metric Autoscaler 2.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780101226",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler 2.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780101239",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator",
            "product": "Custom Metric Autoscaler 2.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779953535",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub 1.3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779210675",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
            "product": "Multicluster Global Hub 1.3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779210608",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator",
            "product": "Multicluster Global Hub 1.3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779209992",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
            "product": "Multicluster Global Hub 1.7.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1779925273",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/acm-grafana-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787645355",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/acm-grafana-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780677003",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:acm:2.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/acm-grafana-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780926805",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777307791",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777307791",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777307791",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777986630",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777986630",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777986630",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777976489",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777976489",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1777976489",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667125",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783666755",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784054598",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055387",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055726",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667517",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667577",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667611",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055020",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667641",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055586",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667790",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667859",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667875",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667869",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783667877",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055576",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055244",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784055382",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783668266",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783668288",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783669219",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/createtree-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780053572",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/certificate-transparency-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780048814",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/trillian-database-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780053572",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/trillian-logserver-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780053572",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/trillian-logsigner-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780053572",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhtas/updatetree-rhel9",
            "product": "Red Hat Trusted Artifact Signer 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780053572",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/keda-adapter",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/keda-operator",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/keda-webhooks",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/assisted-service-9-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/azure-service-operator-mce-211",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel8",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel8",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-operator-bundle",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-rhel8-operator",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-4",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-5",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-6",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-agent-globalhub-1-7",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-4",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-5",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-6",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-manager-globalhub-1-7",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-4",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-5",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-6",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/multicluster-global-hub-operator-globalhub-1-7",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-results-api-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-results-retention-policy-agent-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-operator-bundle",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel7-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_3scale_amp:2"
            ],
            "defaultStatus": "affected",
            "packageName": "3scale-amp2/3scale-rhel9-operator",
            "product": "Red Hat 3scale API Management Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacs-eng/release-operator",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacs-eng/release-roxctl",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacs-eng/release-scanner-v4",
            "product": "Red Hat Advanced Cluster Security 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-alert-exporter",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-alertmanager-proxy",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-api",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-cli-artifacts",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-db-setup",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-pam-issuer",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-periodic",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-telemetry-gateway",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-userinfo-proxy",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/flightctl-worker",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-server",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "caddy",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "go-fdo-server",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-maas-api-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-driver-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-launcher-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-model-registry-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redhat-user-workloads/quay-clair-v3-17",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "affected",
            "packageName": "securesign/trillian-createtree",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "affected",
            "packageName": "securesign/trillian-database",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "affected",
            "packageName": "securesign/trillian-logserver",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "affected",
            "packageName": "securesign/trillian-logsigner",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1"
            ],
            "defaultStatus": "affected",
            "packageName": "securesign/trillian-updatetree",
            "product": "Red Hat Trusted Artifact Signer",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redhat-user-workloads/spiffe-spire-agent-1-13-3",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redhat-user-workloads/spiffe-spire-oidc-discovery-provider-1-13-3",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "redhat-user-workloads/spiffe-spire-server-1-13-3",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/spiffe-spire-agent-1-12-4",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/spiffe-spire-oidc-discovery-provider-1-12-4",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-user-workloads/spiffe-spire-server-1-12-4",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-04-07T15:19:24.344Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 8.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T12:04:28.748Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-33815"
          },
          {
            "name": "RHBZ#2455975",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455975"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33815.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41019"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26636"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22423"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24503"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60388"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24539"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25273"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11070"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:11217"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13791"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:13829"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40984"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24479"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24475"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24482"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17789: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26636: Custom Metric Autoscaler 2.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24503: Multicluster Global Hub 1.7.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60388: Red Hat Advanced Cluster Management for Kubernetes 2.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24539: Red Hat Advanced Cluster Management for Kubernetes 2.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25273: Red Hat Advanced Cluster Management for Kubernetes 2.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11070: Red Hat Advanced Cluster Security 4.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:11217: Red Hat Advanced Cluster Security 4.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13791: Red Hat Advanced Cluster Security 4.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:13829: Red Hat Advanced Cluster Security for Kubernetes 4.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40984: Red Hat Openshift Data Foundation 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24479: Red Hat Trusted Artifact Signer 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24475: Red Hat Trusted Artifact Signer 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24482: Red Hat Trusted Artifact Signer 1.3"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-04-07T16:01:25.130Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-04-07T15:19:24.344Z",
            "value": "Made public."
          }
        ],
        "title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/jackc/pgx/v5/pgproto3",
          "product": "github.com/jackc/pgx/v5/pgproto3",
          "programRoutines": [
            {
              "name": "Bind.Decode"
            },
            {
              "name": "Backend.Receive"
            }
          ],
          "vendor": "github.com/jackc/pgx/v5",
          "versions": [
            {
              "lessThan": "5.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory-safety vulnerability in github.com/jackc/pgx/v5."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-129 \u2014 Improper Validation of Array Index",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-17T18:30:29.157Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4771"
        }
      ],
      "title": "CVE-2026-33815 in github.com/jackc/pgx"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-33815",
    "datePublished": "2026-04-07T15:19:24.344Z",
    "dateReserved": "2026-03-23T20:35:32.814Z",
    "dateUpdated": "2026-09-17T12:04:28.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33818 (GCVE-0-2026-33818)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-09-17 17:35

Title

Enforce maximum recursion depth in encoding/asn1

Summary

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:11 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80405
https://groups.google.com/g/golang-announce/c/94p…
https://go.dev/cl/814980
https://pkg.go.dev/vuln/GO-2026-5972

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/asn1	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Marwan Atia (marwansamir688@gmail.com)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-33818",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:11:19.904646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:12:34.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/asn1",
          "product": "encoding/asn1",
          "programRoutines": [
            {
              "name": "parseSequenceOf"
            },
            {
              "name": "parseField"
            },
            {
              "name": "UnmarshalWithParams"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Marwan Atia (marwansamir688@gmail.com)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T17:35:10.847Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80405"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://go.dev/cl/814980"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "title": "Enforce maximum recursion depth in encoding/asn1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-33818",
    "datePublished": "2026-08-13T21:58:52.821Z",
    "dateReserved": "2026-03-23T20:35:32.815Z",
    "dateUpdated": "2026-09-17T17:35:10.847Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-34040 (GCVE-0-2026-34040)

Vulnerability from cvelistv5 – Published: 2026-03-31 01:36 – Updated: 2026-04-02 03:55

Title

Moby: AuthZ plugin bypass with oversized request body

Summary

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 00:00 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/moby/moby/security/advisories/…	x_refsource_CONFIRM
https://github.com/moby/moby/releases/tag/docker-…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
moby	moby	Affected: < 29.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T03:55:56.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "moby",
          "vendor": "moby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 29.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T01:36:48.205Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"
        },
        {
          "name": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x744-4wpc-v9h2",
        "discovery": "UNKNOWN"
      },
      "title": "Moby: AuthZ plugin bypass with oversized request body"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34040",
    "datePublished": "2026-03-31T01:36:48.205Z",
    "dateReserved": "2026-03-25T15:29:04.744Z",
    "dateUpdated": "2026-04-02T03:55:56.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46604 (GCVE-0-2026-46604)

Vulnerability from cvelistv5 – Published: 2026-06-26 20:22 – Updated: 2026-06-29 13:20

Title

Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image

Summary

The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-29 13:20 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

Go Google root

References

3 references

URL	Tags
https://go.dev/cl/788421
https://go.dev/issue/80122
https://pkg.go.dev/vuln/GO-2026-5066

Impacted products

1 product

Vendor	Product	Version
golang.org/x/image	golang.org/x/image/tiff	Affected: 0 , < 0.43.0 (semver)

Credits

sorte

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-46604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-29T13:20:19.539584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-29T13:20:23.731Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/image/tiff",
          "product": "golang.org/x/image/tiff",
          "programRoutines": [
            {
              "name": "Decode"
            }
          ],
          "vendor": "golang.org/x/image",
          "versions": [
            {
              "lessThan": "0.43.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "sorte"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T20:22:46.377Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/788421"
        },
        {
          "url": "https://go.dev/issue/80122"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5066"
        }
      ],
      "title": "Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-46604",
    "datePublished": "2026-06-26T20:22:46.377Z",
    "dateReserved": "2026-05-15T17:35:00.814Z",
    "dateUpdated": "2026-06-29T13:20:23.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48586 (GCVE-0-2026-48586)

Vulnerability from cvelistv5 – Published: 2026-07-27 11:02 – Updated: 2026-07-27 13:03

Title

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Summary

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 13:03 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

apache mitre root

References

3 references

URL	Tags
https://lists.apache.org/thread/7v3jhgwfbmhx42424…	vendor-advisory
https://lists.apache.org/thread/p008svsjf9p6bj47w…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/0…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Thrift	Affected: 0 , < 0.24.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-27T11:07:36.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T13:03:29.590380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T13:03:46.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "thrift",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://proxy.golang.org",
          "defaultStatus": "unaffected",
          "packageName": "github.com/apache/thrift",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "c_glib",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.thrift:libthrift",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://conan.io/center",
          "defaultStatus": "unaffected",
          "packageName": "thrift",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "D language",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.24.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Thrift: before 0.24.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 0.24.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.\n\nThis issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T11:02:54.430Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-48586",
    "datePublished": "2026-07-27T11:02:54.430Z",
    "dateReserved": "2026-05-21T20:38:07.261Z",
    "dateUpdated": "2026-07-27T13:03:46.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-50151 (GCVE-0-2026-50151)

Vulnerability from cvelistv5 – Published: 2026-07-17 19:41 – Updated: 2026-07-20 13:52

Title

oras-go: credential forwarding via unvalidated Location header in blob upload

Summary

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:52 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/oras-project/oras-go/security/…	x_refsource_CONFIRM
https://github.com/oras-project/oras-go/pull/1152	x_refsource_MISC
https://github.com/oras-project/oras-go/commit/46…	x_refsource_MISC
https://github.com/oras-project/oras-go/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
oras-project	oras-go	Affected: < 2.6.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50151",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:52:00.588088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:52:07.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras-go",
          "vendor": "oras-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller\u0027s credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T19:41:11.648Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
        },
        {
          "name": "https://github.com/oras-project/oras-go/pull/1152",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/pull/1152"
        },
        {
          "name": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991"
        },
        {
          "name": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oras-project/oras-go/releases/tag/v2.6.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jxpm-75mh-9fp7",
        "discovery": "UNKNOWN"
      },
      "title": "oras-go: credential forwarding via unvalidated Location header in blob upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50151",
    "datePublished": "2026-07-17T19:41:11.648Z",
    "dateReserved": "2026-06-03T20:54:20.431Z",
    "dateUpdated": "2026-07-20T13:52:07.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56852 (GCVE-0-2026-56852)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57

Title

Infinite loop on invalid input in golang.org/x/text

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:26 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go Google root

References

3 references

URL	Tags
https://go.dev/issue/80142
https://go.dev/cl/794100
https://pkg.go.dev/vuln/GO-2026-5970

Impacted products

1 product

Vendor	Product	Version
golang.org/x/text	golang.org/x/text/unicode/norm	Affected: 0 , < 0.39.0 (semver)

Credits

Viky Choi ("vikychoi" on GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:26:14.918983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:26:20.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/text/unicode/norm",
          "product": "golang.org/x/text/unicode/norm",
          "programRoutines": [
            {
              "name": "nextComposed"
            },
            {
              "name": "Form.Append"
            },
            {
              "name": "Form.AppendString"
            },
            {
              "name": "Form.Bytes"
            },
            {
              "name": "Form.FirstBoundary"
            },
            {
              "name": "Form.FirstBoundaryInString"
            },
            {
              "name": "Form.IsNormal"
            },
            {
              "name": "Form.IsNormalString"
            },
            {
              "name": "Form.LastBoundary"
            },
            {
              "name": "Form.NextBoundary"
            },
            {
              "name": "Form.NextBoundaryInString"
            },
            {
              "name": "Form.Properties"
            },
            {
              "name": "Form.PropertiesString"
            },
            {
              "name": "Form.QuickSpan"
            },
            {
              "name": "Form.QuickSpanString"
            },
            {
              "name": "Form.Span"
            },
            {
              "name": "Form.SpanString"
            },
            {
              "name": "Form.String"
            },
            {
              "name": "Form.Transform"
            },
            {
              "name": "Iter.Init"
            },
            {
              "name": "Iter.InitString"
            },
            {
              "name": "Iter.Next"
            },
            {
              "name": "Iter.Seek"
            },
            {
              "name": "normReader.Read"
            },
            {
              "name": "normWriter.Write"
            }
          ],
          "vendor": "golang.org/x/text",
          "versions": [
            {
              "lessThan": "0.39.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Viky Choi (\"vikychoi\" on GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T22:57:54.703Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80142"
        },
        {
          "url": "https://go.dev/cl/794100"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "title": "Infinite loop on invalid input in golang.org/x/text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56852",
    "datePublished": "2026-07-21T19:18:59.951Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-10T22:57:54.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56853 (GCVE-0-2026-56853)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23

Title

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Summary

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:22 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80205
https://go.dev/cl/795540
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6089

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:22:45.475320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:23:18.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "conn.readRequest"
            },
            {
              "name": "conn.serve"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.092Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80205"
        },
        {
          "url": "https://go.dev/cl/795540"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56853",
    "datePublished": "2026-08-13T21:58:53.092Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-14T15:23:18.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56858 (GCVE-0-2026-56858)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32

Title

Fix Javascript regexp context tracking in html/template

Summary

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:31 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80435
https://go.dev/cl/807100
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6091

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Ali Sherif

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:31:30.140536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:32:29.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ali Sherif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80435"
        },
        {
          "url": "https://go.dev/cl/807100"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "title": "Fix Javascript regexp context tracking in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56858",
    "datePublished": "2026-08-13T21:58:53.354Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:32:29.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:67842

CVE-2026-32282 (GCVE-0-2026-32282)

CVE-2026-33815 (GCVE-0-2026-33815)

CVE-2026-33818 (GCVE-0-2026-33818)

CVE-2026-34040 (GCVE-0-2026-34040)

CVE-2026-46604 (GCVE-0-2026-46604)

CVE-2026-48586 (GCVE-0-2026-48586)

CVE-2026-50151 (GCVE-0-2026-50151)

CVE-2026-56852 (GCVE-0-2026-56852)

CVE-2026-56853 (GCVE-0-2026-56853)

CVE-2026-56858 (GCVE-0-2026-56858)

Tags

Sightings

Nomenclature

Related by attack behaviour