Red Hat Multicluster Engine for Kubernetes

• CVE-2026-114236 Low 3.3 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers 0.1%
• CVE-2026-71297 Medium 5.4 Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional 0.2%
• CVE-2026-71299 Medium 6.5 Maestro: maestro: rest api write endpoints registered without authentication middleware 0.3%
• CVE-2026-71298 Medium 6.4 Maestro: sql identifier injection via properties.* search filter and orderby field 0.3%
• CVE-2026-101919 High 8.8 Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane 0.4%
• CVE-2026-75924 High 8.7 Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval 0.3%
• CVE-2026-16242 Critical 9.4 Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates 0.9%
• CVE-2026-10805 Medium 6.7 Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend 0.2%
• CVE-2026-10101 Medium 6.3 Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users 0.2%
• CVE-2025-57851 Medium 6.4 Mce: privilege escalation via excessive /etc/passwd permissions 0.1%
• CVE-2026-4740 High 8.2 Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation 0.2%
• CVE-2025-2241 High 8.2 Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm 0.5%
• CVE-2024-12401 Medium 4.4 Cert-manager: potential dos when parsing specially crafted pem inputs 0.7%