RHSA-2026:19108

Vulnerability from csaf_redhat - Published: 2026-05-19 13:54 - Updated: 2026-05-25 07:53
Summary
Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.11.2
Severity
Important
Notes
Topic: Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.11.2 General Availability release, with updates to container images.
Details: Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.11.2 release that simplify the process of deploying OpenShift Container Platform clusters. The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters, or to import existing Kubernetes-based clusters for management. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le —
Workaround
Threats
Impact Important
CVE-2026-34986

A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le —
Workaround
Threats
Impact Important
CVE-2026-35469

A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Service (DoS) by causing the affected components to become unresponsive.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64 —
Vendor Fix fix
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64 —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x —
Workaround
Unresolved product id: multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le —
Workaround
Threats
Impact Important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.11.2 General Availability release, with updates to container images.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Assisted Installer RHEL 9 integrates components for the general multicluster engine\nfor Kubernetes 2.11.2 release that simplify the process of deploying OpenShift Container\nPlatform clusters.\n\nThe multicluster engine for Kubernetes provides the foundational components\nthat are necessary for the centralized management of multiple\nKubernetes-based clusters across data centers, public clouds, and private\nclouds.\n\nYou can use the engine to create new Red Hat OpenShift Container Platform\nclusters, or to import existing Kubernetes-based clusters for management.\n\nAfter the clusters are managed, you can use the APIs that\nare provided by the engine to distribute configuration based on placement\npolicy.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:19108",
        "url": "https://access.redhat.com/errata/RHSA-2026:19108"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34986"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35469",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35469"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_19108.json"
      }
    ],
    "title": "Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.11.2",
    "tracking": {
      "current_release_date": "2026-05-25T07:53:15+00:00",
      "generator": {
        "date": "2026-05-25T07:53:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2026:19108",
      "initial_release_date": "2026-05-19T13:54:25+00:00",
      "revision_history": [
        {
          "date": "2026-05-19T13:54:25+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-19T13:54:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-25T07:53:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "multicluster engine for Kubernetes 2.11",
                "product": {
                  "name": "multicluster engine for Kubernetes 2.11",
                  "product_id": "multicluster engine for Kubernetes 2.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:multicluster_engine:2.11::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "multicluster engine for Kubernetes"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182528"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182554"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3A93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182618"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3Abed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182571"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3Ab90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1778892370"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3A571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182528"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182554"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3A938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182618"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3A8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182571"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3Af0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1778892370"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3Ace084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182528"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182554"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3Ab63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182618"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3A58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182571"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3Afb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1778892370"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-image-service-rhel9@sha256%3Abdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182528"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-rhel9@sha256%3A6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182554"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-agent-rhel9@sha256%3A27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182618"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-installer-controller-rhel9@sha256%3Ad914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1779182571"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
                  "product_id": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/assisted-service-9-rhel9@sha256%3Aa85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-engine\u0026tag=1778892370"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64 as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le as a component of multicluster engine for Kubernetes 2.11",
          "product_id": "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le",
        "relates_to_product_reference": "multicluster engine for Kubernetes 2.11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
        ],
        "known_not_affected": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-19T13:54:25+00:00",
          "details": "For more information about Assisted Installer, see the following documentation:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#cim-intro\n\nFor multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro\n\nThis documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.16.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:19108"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-34986",
      "cwe": {
        "id": "CWE-131",
        "name": "Incorrect Calculation of Buffer Size"
      },
      "discovery_date": "2026-04-06T17:01:34.639203+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455470"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
        ],
        "known_not_affected": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455470",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
          "url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
        }
      ],
      "release_date": "2026-04-06T16:22:45.353000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-19T13:54:25+00:00",
          "details": "For more information about Assisted Installer, see the following documentation:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#cim-intro\n\nFor multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro\n\nThis documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.16.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:19108"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
    },
    {
      "cve": "CVE-2026-35469",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-13T03:52:35+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457729"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Service (DoS) by causing the affected components to become unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw affecting OpenShift Container Platform. An attacker with specific elevated cluster roles, such as those permitting pod port forwarding, execution, attachment, or node proxying, could exploit a vulnerability in the SPDY streaming code of Kubelet, CRI-O, and kube-apiserver, leading to unresponsiveness of these critical components.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
        ],
        "known_not_affected": [
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
          "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35469"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457729",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457729"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35469",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35469"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35469",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35469"
        }
      ],
      "release_date": "2026-04-13T23:59:59+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-19T13:54:25+00:00",
          "details": "For more information about Assisted Installer, see the following documentation:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#cim-intro\n\nFor multicluster engine for Kubernetes, see the following documentation for\ndetails on how to install the images:\n\nhttps://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/clusters/cluster_mce_overview#mce-install-intro\n\nThis documentation will be available after the general availability release of Red Hat Advanced Cluster Management 2.16.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:19108"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended.",
          "product_ids": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:571bbf5386c664f54fad514b1d04f4b3b01162e32b464d7707171807cfa2cf44_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:8a4df62ddba452378bc553cc94ca0d672d10a86f45e609dd0117e56caf72763a_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:bdf657fe8b0c9ab539ec474052f403a2fc79833fc2479079ba9e7eaf7880dd93_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:ce084ef4b38c390778b20c96b48d78837bd3609281db82a15a28eed65ac9df41_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:27709bd7f3b1bf435b7f016d19ac36f7fc9ebc9ac5d1af13ee00a19a362366a2_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:938acf1d06fc33bbf5c9432d5953a10d02fed45824b776248e041b05af129c08_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:93e7b5d6eb7fcb89150d6e90c9a9c16a793ee96244eaca65aab0a326a12be2db_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-agent-rhel9@sha256:b63da7b89b6a8335394e05e4a83a18d7019e7f0ad6c32166de0f65bf44d5e82c_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:58bd75f698338aab4cc8c04e28530368dece860c4741f8a2926f72726671e8e1_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:8e30a737c67effb5163936e217da3cf4528abc501b42f109371f2e14cd2fb43b_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:bed53a9e264eb42cff85a3db9e08f869713fa1c64c94b2bd3fa5223720a8bb19_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-controller-rhel9@sha256:d914e7f8a2993fc12783e985475c9d759335f360b111c380d9e90bad1bf8236e_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6184e752f0e4d70c71448cd9c237171ad5efb18f8fa748e3e483b12c610a6a71_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:64bb85c01610436d1ca8d924e6a806d9505d4fcb7240bd53df7df6d22f0eb2ed_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f21637ae5536f0a9064ff0e8ad658d8bfdf0939c771f90809698199ee670837_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-installer-rhel9@sha256:6f33768139cfb4068f1f2d9887a5705947941f20aece137ae479567f9551786a_ppc64le",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:a85b56510f1414be81c5ba10601b92bc7acdd91d92c80422278aae7733b02f87_s390x",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:b90069a7f8a34aec8298179773ffe9c500534ce423d4eb25104ec7d66f279b06_amd64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:f0d9c2b1fa4a0a29f607d4ee0bba2405c15018bbc3d437bbe4f1385017f780c2_arm64",
            "multicluster engine for Kubernetes 2.11:registry.redhat.io/multicluster-engine/assisted-service-9-rhel9@sha256:fb238966a44e31d1b2b23e6d2b236296dd9e4808c330fef0eef8ce50f698dc3c_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.