Vulnerability-Lookup

RHSA-2026:68515

Vulnerability from csaf_redhat - Published: 2026-09-17 05:44 - Updated: 2026-09-23 17:34

Summary

Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update

Severity

Important

Notes

Topic: Multicluster Global Hub v1.8.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x	—	Workaround

Threats

Impact Important

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x		—

Threats

Impact Important

CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Important

CVE-2026-42502

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Moderate

CVE-2026-46604

A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leading to the unavailability of the affected system.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Moderate

CVE-2026-48586

A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Important

CVE-2026-50151

A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller's credentials, leading to information disclosure. Additionally, it can enable client-side Server-Side Request Forgery (SSRF) to a cross-host target.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-522 - Insufficiently Protected Credentials

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Moderate

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-71235

A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 4 products, the same list as for CVE-2026-33818

Known not affected 17 products, the same list as for CVE-2026-33818

Threats

Impact Important

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

CWE-345 - Insufficient Verification of Data Authenticity

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x	—	Workaround

Threats

Impact Important

CVE-2026-71577

A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.

6.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE-522 - Insufficiently Protected Credentials

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64	—	Vendor Fix fix Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x	—	Vendor Fix fix Workaround

Known not affected 17 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64	—	Workaround
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le	—	Workaround

Threats

Impact Moderate

CVE-2026-75762

No description is available for this CVE.

8.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Affected products

Fixed 12 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x	—	Vendor Fix fix

Known not affected 9 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le		—

Threats

Impact Important

CVE-2026-77849

No description is available for this CVE.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Important

CVE-2026-79921

A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Important

CVE-2026-80220

No description is available for this CVE.

5.4 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Fixed 4 products

Product	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64	—	Vendor Fix fix
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le	—	Vendor Fix fix

Known not affected 17 products

Product	Identifier	Version	Remediation
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64		—
Unresolved product id: Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x		—

Threats

Impact Important

CVE-2026-80221

No description is available for this CVE.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Fixed 4 products, the same list as for CVE-2026-17106

Known not affected 17 products, the same list as for CVE-2026-17106

Threats

Impact Important

References

144 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:68515	self
https://access.redhat.com/security/cve/CVE-2026-17106	external
https://access.redhat.com/security/cve/CVE-2026-33818	external
https://access.redhat.com/security/cve/CVE-2026-41178	external
https://access.redhat.com/security/cve/CVE-2026-42502	external
https://access.redhat.com/security/cve/CVE-2026-46604	external
https://access.redhat.com/security/cve/CVE-2026-48586	external
https://access.redhat.com/security/cve/CVE-2026-50151	external
https://access.redhat.com/security/cve/CVE-2026-56852	external
https://access.redhat.com/security/cve/CVE-2026-56853	external
https://access.redhat.com/security/cve/CVE-2026-56858	external
https://access.redhat.com/security/cve/CVE-2026-56859	external
https://access.redhat.com/security/cve/CVE-2026-56860	external
https://access.redhat.com/security/cve/CVE-2026-56862	external
https://access.redhat.com/security/cve/CVE-2026-71235	external
https://access.redhat.com/security/cve/CVE-2026-71576	external
https://access.redhat.com/security/cve/CVE-2026-71577	external
https://access.redhat.com/security/cve/CVE-2026-75762	external
https://access.redhat.com/security/cve/CVE-2026-77849	external
https://access.redhat.com/security/cve/CVE-2026-79921	external
https://access.redhat.com/security/cve/CVE-2026-80220	external
https://access.redhat.com/security/cve/CVE-2026-80221	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-17106	self
https://bugzilla.redhat.com/show_bug.cgi?id=2518147	external
https://www.cve.org/CVERecord?id=CVE-2026-17106	external
https://nvd.nist.gov/vuln/detail/CVE-2026-17106	external
https://docs.docker.com/desktop/release-notes/#4860	external
https://docs.docker.com/engine/release-notes/29/#2970	external
https://github.com/docker/cli/releases/tag/v29.7.0	external
https://github.com/docker/compose/releases/tag/v5.4.0	external
https://github.com/docker/sbx-releases/releases/t…	external
https://github.com/moby/go-archive/releases/tag/v0.3.0	external
https://github.com/moby/go-archive/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-41178	self
https://bugzilla.redhat.com/show_bug.cgi?id=2484830	external
https://www.cve.org/CVERecord?id=CVE-2026-41178	external
https://nvd.nist.gov/vuln/detail/CVE-2026-41178	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://github.com/open-telemetry/opentelemetry-g…	external
https://access.redhat.com/security/cve/CVE-2026-42502	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480762	external
https://www.cve.org/CVERecord?id=CVE-2026-42502	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42502	external
https://go.dev/cl/781701	external
https://go.dev/issue/79572	external
https://groups.google.com/g/golang-announce/c/iI-…	external
https://pkg.go.dev/vuln/GO-2026-5027	external
https://access.redhat.com/security/cve/CVE-2026-46604	self
https://bugzilla.redhat.com/show_bug.cgi?id=2493766	external
https://www.cve.org/CVERecord?id=CVE-2026-46604	external
https://nvd.nist.gov/vuln/detail/CVE-2026-46604	external
https://go.dev/cl/788421	external
https://go.dev/issue/80122	external
https://pkg.go.dev/vuln/GO-2026-5066	external
https://access.redhat.com/security/cve/CVE-2026-48586	self
https://bugzilla.redhat.com/show_bug.cgi?id=2507434	external
https://www.cve.org/CVERecord?id=CVE-2026-48586	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48586	external
http://www.openwall.com/lists/oss-security/2026/0…	external
https://lists.apache.org/thread/7v3jhgwfbmhx42424…	external
https://lists.apache.org/thread/p008svsjf9p6bj47w…	external
https://access.redhat.com/security/cve/CVE-2026-50151	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499693	external
https://www.cve.org/CVERecord?id=CVE-2026-50151	external
https://nvd.nist.gov/vuln/detail/CVE-2026-50151	external
https://github.com/oras-project/oras-go/security/…	external
https://access.redhat.com/security/cve/CVE-2026-56852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233	external
https://www.cve.org/CVERecord?id=CVE-2026-56852	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852	external
https://go.dev/cl/794100	external
https://go.dev/issue/80142	external
https://pkg.go.dev/vuln/GO-2026-5970	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external
https://access.redhat.com/security/cve/CVE-2026-71235	self
https://www.cve.org/CVERecord?id=CVE-2026-71235	external
https://access.redhat.com/security/cve/CVE-2026-71576	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512513	external
https://www.cve.org/CVERecord?id=CVE-2026-71576	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71576	external
https://access.redhat.com/security/cve/CVE-2026-71577	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512514	external
https://www.cve.org/CVERecord?id=CVE-2026-71577	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71577	external
https://access.redhat.com/security/cve/CVE-2026-75762	self
https://www.cve.org/CVERecord?id=CVE-2026-75762	external
https://access.redhat.com/security/cve/CVE-2026-77849	self
https://www.cve.org/CVERecord?id=CVE-2026-77849	external
https://access.redhat.com/security/cve/CVE-2026-79921	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524713	external
https://www.cve.org/CVERecord?id=CVE-2026-79921	external
https://nvd.nist.gov/vuln/detail/CVE-2026-79921	external
https://github.com/rabbitmq/amqp091-go/commit/6be…	external
https://github.com/rabbitmq/amqp091-go/pull/353	external
https://github.com/rabbitmq/amqp091-go/releases/t…	external
https://github.com/rabbitmq/amqp091-go/security/a…	external
https://access.redhat.com/security/cve/CVE-2026-80220	self
https://www.cve.org/CVERecord?id=CVE-2026-80220	external
https://access.redhat.com/security/cve/CVE-2026-80221	self
https://www.cve.org/CVERecord?id=CVE-2026-80221	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multicluster Global Hub v1.8.2 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:68515",
        "url": "https://access.redhat.com/errata/RHSA-2026:68515"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-17106",
        "url": "https://access.redhat.com/security/cve/CVE-2026-17106"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41178",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-46604",
        "url": "https://access.redhat.com/security/cve/CVE-2026-46604"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48586",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-50151",
        "url": "https://access.redhat.com/security/cve/CVE-2026-50151"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71235",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71235"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71576",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71576"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71577",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71577"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-75762",
        "url": "https://access.redhat.com/security/cve/CVE-2026-75762"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-77849",
        "url": "https://access.redhat.com/security/cve/CVE-2026-77849"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-79921",
        "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80220",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80220"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-80221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-80221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68515.json"
      }
    ],
    "title": "Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update",
    "tracking": {
      "current_release_date": "2026-09-23T17:34:26+00:00",
      "generator": {
        "date": "2026-09-23T17:34:26+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:68515",
      "initial_release_date": "2026-09-17T05:44:50+00:00",
      "revision_history": [
        {
          "date": "2026-09-17T05:44:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-17T05:44:54+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-23T17:34:26+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Multicluster Global Hub 1.8.2",
                "product": {
                  "name": "Multicluster Global Hub 1.8.2",
                  "product_id": "Multicluster Global Hub 1.8.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:multicluster_globalhub:1.8::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Multicluster Global Hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Acf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788441983"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788359470"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788359454"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1788496240"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Acb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788359461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200121"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788441983"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788359470"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aa0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788359454"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788359461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200121"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Acf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788441983"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788359470"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aa6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788359454"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Aa99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788359461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ab1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200121"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1788441983"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1788359470"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1788359454"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ad20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1788359461"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1788200121"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64 as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x as a component of Multicluster Global Hub 1.8.2",
          "product_id": "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x",
        "relates_to_product_reference": "Multicluster Global Hub 1.8.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-17106",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "discovery_date": "2026-08-18T18:51:06.836464+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2518147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or overwrite files at arbitrary locations on the system where the archive is being extracted. This could lead to unauthorized modification of system files or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important severity vulnerability in `moby/go-archive` allows for arbitrary file writes during tar extraction. An attacker providing a specially crafted tar archive can exploit symlink following to create or overwrite files outside the intended directory, potentially leading to system compromise in environments processing untrusted archives, such as container build systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "RHBZ#2518147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-17106",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17106"
        },
        {
          "category": "external",
          "summary": "https://docs.docker.com/desktop/release-notes/#4860",
          "url": "https://docs.docker.com/desktop/release-notes/#4860"
        },
        {
          "category": "external",
          "summary": "https://docs.docker.com/engine/release-notes/29/#2970",
          "url": "https://docs.docker.com/engine/release-notes/29/#2970"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/cli/releases/tag/v29.7.0",
          "url": "https://github.com/docker/cli/releases/tag/v29.7.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/compose/releases/tag/v5.4.0",
          "url": "https://github.com/docker/compose/releases/tag/v5.4.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0",
          "url": "https://github.com/docker/sbx-releases/releases/tag/v0.38.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/go-archive/releases/tag/v0.3.0",
          "url": "https://github.com/moby/go-archive/releases/tag/v0.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h",
          "url": "https://github.com/moby/go-archive/security/advisories/GHSA-hfg8-hc9c-6c3h"
        }
      ],
      "release_date": "2026-08-18T18:35:13.465000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing tar archives from untrusted sources. When handling archives from potentially untrusted origins, ensure that the extraction process is executed with the least privileges necessary to limit the impact of any arbitrary file write attempts.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-42502",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:01:11.151484+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781701",
          "url": "https://go.dev/cl/781701"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79572",
          "url": "https://go.dev/issue/79572"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5027",
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "release_date": "2026-05-22T15:01:21.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
    },
    {
      "cve": "CVE-2026-46604",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "discovery_date": "2026-06-26T21:05:50.463844+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the golang.org/x/image/tiff component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted, invalid TIFF image. When the TIFF decoder attempts to process an image with an out-of-bounds strip offset, it can panic, leading to the unavailability of the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the golang.org/x/image/tiff package. The TIFF decoder does not validate strip offsets read from a TIFF Image File Directory (IFD) before dereferencing them. Processing a specially crafted, invalid TIFF image with an out-of-bounds strip offset triggers a runtime panic, causing a denial of service in any application that decodes attacker-supplied TIFF images, such as thumbnail generators, document processors, or image upload handlers. Exploitation requires the application to decode a malicious TIFF file supplied by the attacker (CVSS UI:R); there is no impact to confidentiality or integrity, only availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46604",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46604",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46604"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/788421",
          "url": "https://go.dev/cl/788421"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80122",
          "url": "https://go.dev/issue/80122"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5066",
          "url": "https://pkg.go.dev/vuln/GO-2026-5066"
        }
      ],
      "release_date": "2026-06-26T20:22:46.377000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "There is no complete inline mitigation for this issue; the fix requires upgrading golang.org/x/image to version 0.43.0 or later, which validates the strip offset before use. Where an immediate upgrade is not possible, exposure can be reduced by not decoding untrusted or externally supplied TIFF images, or by isolating TIFF decoding in a sandboxed, restartable worker process so a panic does not crash the primary service.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/image/tiff: golang.org/x/image/tiff: Denial of Service via invalid TIFF image"
    },
    {
      "cve": "CVE-2026-48586",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-27T12:01:11.736259+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507434"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Thrift\u0027s handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507434",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/24/37",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
          "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq",
          "url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
        }
      ],
      "release_date": "2026-07-27T11:02:54.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data"
    },
    {
      "cve": "CVE-2026-50151",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2026-07-01T21:35:45+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499693"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in oras-go. During the monolithic blob upload process, oras-go reuses the Authorization header for subsequent requests, even if a malicious registry provides a cross-host Location header. This vulnerability allows an attacker-controlled endpoint to receive the caller\u0027s credentials, leading to information disclosure. Additionally, it can enable client-side Server-Side Request Forgery (SSRF) to a cross-host target.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in oras-go. During monolithic blob upload, the Authorization header is reused for cross-host Location redirects, allowing a malicious registry to exfiltrate caller credentials.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499693",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499693"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50151"
        },
        {
          "category": "external",
          "summary": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7",
          "url": "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"
        }
      ],
      "release_date": "2026-07-01T21:35:45+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Upgrade to oras-go v2.6.1 or later.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    },
    {
      "cve": "CVE-2026-71235",
      "discovery_date": "2026-08-05T12:07:04.533964+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Magistrala\u0027s Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access to internal databases, and Server-Side Request Forgery (SSRF) against internal microservices. This could lead to significant data compromise and unauthorized system access.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71235"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71235",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71235"
        }
      ],
      "release_date": "2026-08-05T10:56:25.198000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/absmach/magistrala: Magistrala IoT Platform: Arbitrary Code Execution via Unrestricted Script Execution"
    },
    {
      "cve": "CVE-2026-71576",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2026-08-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512513"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multicluster-global-hub: multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw where a compromised managed hub, possessing a valid Kafka client certificate, can impersonate other hubs within the Multicluster Global Hub environment. This allows an attacker to falsify or delete critical compliance, inventory, and cluster health data, leading to significant data integrity issues.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71576"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512513",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512513"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71576",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71576"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71576",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71576"
        }
      ],
      "release_date": "2026-08-10T14:38:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multicluster-global-hub: multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers"
    },
    {
      "cve": "CVE-2026-71577",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "discovery_date": "2026-08-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512514"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multicluster-global-hub: multicluster-global-hub: Spec-topic Read ACL leaks bootstrap kubeconfigs to all managed hubs during migration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in multicluster-global-hub allows a compromised managed hub to obtain a long-lived API server token for a target hub during a ManagedClusterMigration. This occurs because the operator grants broad read access to the shared Kafka topic and transmits bootstrap kubeconfigs with extended token validity in plaintext. Exploitation requires both a prior compromise of a managed hub and an active migration initiated by a global-hub administrator.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71577"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512514",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512514"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71577",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71577"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71577",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71577"
        }
      ],
      "release_date": "2026-08-10T14:38:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "multicluster-global-hub: multicluster-global-hub: Spec-topic Read ACL leaks bootstrap kubeconfigs to all managed hubs during migration"
    },
    {
      "cve": "CVE-2026-75762",
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-75762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-75762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-75762"
        }
      ],
      "release_date": "2026-08-31T13:49:12.863000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multicluster-global-hub: Manager trusts self-asserted evt.Source() for leaf-hub identity in all status handlers"
    },
    {
      "cve": "CVE-2026-77849",
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77849",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77849"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana-global-hub: grafana-global-hub: Hardcoded Grafana admin credentials (admin / admin) in `pkg/specsyncer`"
    },
    {
      "cve": "CVE-2026-79921",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-26T21:01:49.454950+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524713"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in amqp091-go, a Go AMQP 0.9.1 client. A malicious AMQP broker could exploit this by sending oversized data frames, forcing the client to allocate excessive memory. This can lead to unexpected memory consumption and potentially cause the application to become unavailable, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the amqp091-go client can lead to a denial of service in Red Hat products. A compromised or malicious AMQP broker could exploit this by sending oversized payloads, forcing the client to consume excessive memory and potentially causing application-layer service disruption. The impact is considered Important due to the potential for resource exhaustion and disruption of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524713",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524713"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-79921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79921"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0",
          "url": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/pull/353",
          "url": "https://github.com/rabbitmq/amqp091-go/pull/353"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp",
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"
        }
      ],
      "release_date": "2026-08-26T20:24:58.115000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads"
    },
    {
      "cve": "CVE-2026-80220",
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80220",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80220"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "postgres-exporter: postgres-exporter: pprof profiling endpoints exposed on unauthenticated metrics listener"
    },
    {
      "cve": "CVE-2026-80221",
      "discovery_date": "2026-07-01T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
        ],
        "known_not_affected": [
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
          "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80221"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80221"
        }
      ],
      "release_date": "2026-08-31T13:48:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-17T05:44:50+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/multicluster_global_hub/index",
          "product_ids": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:2eaab1aa06261c35b7f3fec47792b7884ae04bbb5e631080097c33dbd9ba2a82_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:4d0554bf41068beee732eac112e5c149dec452f7292a70bef9e9507ed9857be7_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7c4e86d18a27db792f81bdaca580e5d444bb051d6ed69be5c7fb729bee023490_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9187be523aa0e681bbf08ef19b615269ce0ba3f6a952fe0aa6461bb3b9008795_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:02cfdd71deb8fad770bcc7df04e3ce6714fac89d1204796ee2098db9c2d334d0_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:8408aa29230ad808dbb415e6ba6676fb20d4a092d51bef3350b803a5fc3173c4_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf3ca46916a9fb1ec3b3a58a61f450cd72a9d96c7e1025373b830f288ac897fa_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cf4cf3becce69c5e75b3987afaeb06833e92393b178f51ab366f13d224e8f8de_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6c0b3f002aac0debb7d52811d21d9f8fc9d0cf2e9d2aaf92a8f47bf8093481c7_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:991fc487eaa4357cd0a2e87e44780e040ee62bf85bbed4ef009e44f0ca88c304_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a0f75fc098b74a93989ba73ae780026e549e880ccdca020aaf1a7cb61ec99860_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a6263ed1836ad0d34d120a43b09dcbb2e66a1a57cebc70ebbb6e43ef792ea506_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:67ee22bc6faf683e8ae37ba3cfb4152e6e14bcb477e9929dc27c99062dd8bf01_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d918eb2a8f66bb88309d3c664a39fdf5f4b114affe94fe53e0b40c530d62cf7_s390x",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:620b374cb76bab0d293481ba3540cdd22663ef9fb67d4f5963726fd2ac4f9b75_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:783a800f8a138e3248ca96f861eda148720fd4ba863bc4fae45af754dcce542d_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:b1feb02ae99a463d9e6319b71ac4a3eda47de42d5c55142dc03fcf7f003dc24a_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:6f87d47921c4b6161c6ead31676870b12f79ba240c478dd35ff5652313f949fa_arm64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:a99ee13ca3a00455bbdeadbffe28c658764a2a938e09e16d15324fe68a0c0e00_ppc64le",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:cb7614e99220c6c8a7aad2d3d825a257b02a6404843f89d593f1a9d61ad22348_amd64",
            "Multicluster Global Hub 1.8.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d20697adb726ca17dcfec5d1773bd6a43e0c5c82bf730354f7c7aab83e33fbb9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana-global-hub: grafana-global-hub: Direct database connection string with embedded credentials passed as environment variable"
    }
  ]
}

CVE-2026-56859 (GCVE-0-2026-56859)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21

Title

Add recursion depth guard during decode in encoding/xml

Summary

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:21 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80481
https://go.dev/cl/803320
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6088

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/xml	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:21:09.615961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:21:46.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.push"
            },
            {
              "name": "Decoder.pop"
            },
            {
              "name": "Decoder.RawToken"
            },
            {
              "name": "Decoder.unmarshalPath"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.Skip"
            },
            {
              "name": "Decoder.Token"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:52.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80481"
        },
        {
          "url": "https://go.dev/cl/803320"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "title": "Add recursion depth guard during decode in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56859",
    "datePublished": "2026-08-13T21:58:52.959Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:21:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56862 (GCVE-0-2026-56862)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29

Title

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Summary

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80528
https://go.dev/cl/804261
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6090

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Qi Deng of Aurascape.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:27:34.651997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:29:41.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.readRecordOrCCS"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qi Deng of Aurascape.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.216Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80528"
        },
        {
          "url": "https://go.dev/cl/804261"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56862",
    "datePublished": "2026-08-13T21:58:53.216Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:29:41.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71235 (GCVE-0-2026-71235)

Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45

Title

Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Summary

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 12:51 UTC

CWE

CWE-94 - Code Injection

Assigner

TuranSec redhat root

References

1 reference

URL	Tags
https://github.com/absmach/magistrala	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
absmach	magistrala	Affected: 0

Date Public

2026-08-05 10:56

Credits

alibek baxtiyarov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T12:51:37.660677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T12:59:05.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "magistrala",
          "programFiles": [
            "re/golang.go",
            "re/lua.go"
          ],
          "vendor": "absmach",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "alibek baxtiyarov"
        }
      ],
      "datePublic": "2026-08-05T10:56:25.198Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMagistrala\u0027s Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).\u003c/p\u003e"
            }
          ],
          "value": "Magistrala\u0027s Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:45:36.029Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/absmach/magistrala"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71235",
    "datePublished": "2026-08-05T10:56:25.198Z",
    "dateReserved": "2026-08-05T10:53:53.175Z",
    "dateUpdated": "2026-08-10T11:45:36.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71576 (GCVE-0-2026-71576)

Vulnerability from cvelistv5 – Published: 2026-08-10 16:41 – Updated: 2026-09-21 10:32

Title

Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

Summary

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 15:44 UTC

CWE

CWE-345 - Insufficient Verification of Data Authenticity

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:67516	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-71576	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2512513	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Multicluster Global Hub 1.4.9	Unaffected: 1788355599 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Multicluster Global Hub 1.7.3	Unaffected: 1788377424 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Multicluster Global Hub 1.8.2	Unaffected: 1788359454 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.8::el9

Date Public

2026-08-10 14:38

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71576",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T15:44:50.677334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T15:45:08.195Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
          "product": "Multicluster Global Hub 1.4.9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788355599",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
          "product": "Multicluster Global Hub 1.7.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788377424",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-manager-rhel9",
          "product": "Multicluster Global Hub 1.8.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788359454",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-08-10T14:38:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cluster health information, belonging to other hubs in the database."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T10:32:13.180Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:67516",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:67516"
        },
        {
          "name": "RHSA-2026:67842",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "name": "RHSA-2026:68515",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-71576"
        },
        {
          "name": "RHBZ#2512513",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512513"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-07T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-10T14:38:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-345: Insufficient Verification of Data Authenticity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-71576",
    "datePublished": "2026-08-10T16:41:53.193Z",
    "dateReserved": "2026-08-07T14:20:37.114Z",
    "dateUpdated": "2026-09-21T10:32:13.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71577 (GCVE-0-2026-71577)

Vulnerability from cvelistv5 – Published: 2026-08-10 16:43 – Updated: 2026-09-21 11:29

Title

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

Summary

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 01:59 UTC

CWE

CWE-522 - Insufficiently Protected Credentials

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:67516	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:68515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-71577	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2512514	issue-trackingx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Red Hat	Multicluster Global Hub 1.4.9	Unaffected: 1788355417 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.4::el9
Red Hat	Multicluster Global Hub 1.7.3	Unaffected: 1788372439 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.7::el9
Red Hat	Multicluster Global Hub 1.8.2	Unaffected: 1788359461 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.8::el9

Date Public

2026-08-10 14:38

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T01:59:24.928197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T01:59:34.075Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator",
          "product": "Multicluster Global Hub 1.4.9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788355417",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.7::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator",
          "product": "Multicluster Global Hub 1.7.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788372439",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.8::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-rhel9-operator",
          "product": "Multicluster Global Hub 1.8.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1788359461",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "datePublic": "2026-08-10T14:38:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:29:47.718Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:67516",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:67516"
        },
        {
          "name": "RHSA-2026:67842",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:67842"
        },
        {
          "name": "RHSA-2026:68515",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:68515"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-71577"
        },
        {
          "name": "RHBZ#2512514",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512514"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-07T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-10T14:38:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-522: Insufficiently Protected Credentials"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-71577",
    "datePublished": "2026-08-10T16:43:20.185Z",
    "dateReserved": "2026-08-07T14:20:37.114Z",
    "dateUpdated": "2026-09-21T11:29:47.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-79921 (GCVE-0-2026-79921)

Vulnerability from cvelistv5 – Published: 2026-08-26 20:24 – Updated: 2026-08-29 02:50

Title

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Summary

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-29 02:50 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/rabbitmq/amqp091-go/security/a…	x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/353	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/6be…	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
rabbitmq	amqp091-go	Affected: < 1.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79921",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-29T02:50:10.896064Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-29T02:50:25.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol\u0027s built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T20:24:58.115Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/pull/353",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/pull/353"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-6c5v-hqjr-5xxp",
        "discovery": "UNKNOWN"
      },
      "title": "amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-79921",
    "datePublished": "2026-08-26T20:24:58.115Z",
    "dateReserved": "2026-08-25T14:59:32.746Z",
    "dateUpdated": "2026-08-29T02:50:25.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:68515

CVE-2026-56859 (GCVE-0-2026-56859)

CVE-2026-56860 (GCVE-0-2026-56860)

CVE-2026-56862 (GCVE-0-2026-56862)

CVE-2026-71235 (GCVE-0-2026-71235)

CVE-2026-71576 (GCVE-0-2026-71576)

CVE-2026-71577 (GCVE-0-2026-71577)

CVE-2026-79921 (GCVE-0-2026-79921)

Tags

Sightings

Nomenclature

Related by attack behaviour