multicluster engine 2.7 vulnerabilities (CVE)

CVE records published for multicluster engine 2.7, newest first. Follow to get an email when a new one appears.

8 results

6.1Medium

CVE-2026-7163 6 months ago

Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

assisted-service; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.7

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbi…

7.5High

CVE-2026-34986 7 months ago

Go JOSE affect by a panic in JWE decryption

go-jose go-jose; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JS…

8.7High

CVE-2026-29063 8 months ago

Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

immutable-js immutable-js; Red Hat Cluster Observability Operator 1.5.0; Red Hat Migration Toolkit for Virtualization 2.1; Red Hat Migration Toolkit for Virtualization 2.9

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been pa…

7.5High

CVE-2026-25639 9 months ago

Axios affected by Denial of Service via proto Key in mergeConfig

axios axios; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.6

Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can tr…

2.8%EPSS

7.5High

CVE-2025-61726 9 months ago

Memory exhaustion in query parameter parsing in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.3.1; Red Hat HawtIO HawtIO 4.4.0

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

2.3%EPSS

6.9Medium

CVE-2025-13465 9 months ago

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Lodash lodash; Lodash lodash-amd; Lodash lodash-es; Lodash lodash.unset

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

1.8%EPSS

8.0High

CVE-2026-22029 10 months ago

React Router vulnerable to XSS via Open Redirects

remix-run react-router; remix-run @remix-run/router; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unsta…

6.4Medium

CVE-2025-7195 1 year ago

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

operator-framework operator-sdk; Red Hat RHEL-9-CNV-4.17; Red Hat RHEL-9-CNV-4.18; Red Hat RHEL-9-CNV-4.20

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…