Vulnerabilities of Red Hat multicluster engine for Kubernetes 2.11.0

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-73267	A flaw was found in the clusterclaims-controller component of multicluster engine (MCE)	7.7 High	Aug 21, 2026
CVE-2026-75569	A flaw was found in mce-operator-bundle	7.7 High	Aug 19, 2026
CVE-2026-66794	A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes	9.3 Critical	Aug 19, 2026
CVE-2026-66795	A flaw was found in the managedcluster-import-controller	9.9 Critical	Aug 17, 2026
CVE-2026-73266	A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE)	7.1 High	Aug 13, 2026
CVE-2026-73268	A flaw was found in the cluster-curator-controller component of multicluster engine (MCE)	9.9 Critical	Aug 12, 2026
CVE-2026-17107	A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes…	8.5 High	Jul 24, 2026
CVE-2026-16242	A flaw was found in the Konnectivity proxy-server configuration for hosted control planes	9.4 Critical	Jul 20, 2026
CVE-2026-6322	fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them…	7.5 High	May 5, 2026
CVE-2026-7163	A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the…	6.1 Medium	Apr 30, 2026
CVE-2026-42039	Axios is a promise based HTTP client for the browser and Node.js	6.9 Medium	Apr 24, 2026
CVE-2026-42041	Axios is a promise based HTTP client for the browser and Node.js	4.8 Medium	Apr 24, 2026
CVE-2026-42043	Axios is a promise based HTTP client for the browser and Node.js	7.2 High	Apr 24, 2026
CVE-2026-42044	Axios is a promise based HTTP client for the browser and Node.js	6.5 Medium	Apr 24, 2026
CVE-2026-42033	Axios is a promise based HTTP client for the browser and Node.js	7.4 High	Apr 24, 2026
CVE-2026-40895	follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows…	6.9 Medium	Apr 21, 2026
CVE-2026-35469	spdystream is a Go library for multiplexing streams over SPDY connections	8.7 High	Apr 16, 2026
CVE-2026-32280	During chain building, the amount of work that is done is not correctly limited when a large number of intermediate…	7.5 High	Apr 8, 2026
CVE-2026-29181	OpenTelemetry-Go is the Go implementation of OpenTelemetry	7.5 High	Apr 7, 2026
CVE-2026-4740	A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM)	8.2 High	Apr 7, 2026
CVE-2026-34986	Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…	7.5 High	Apr 6, 2026
CVE-2026-33186	gRPC-Go is the Go language implementation of gRPC	9.1 Critical	Mar 20, 2026
CVE-2026-29063	Immutable.js provides many Persistent Immutable data structures	8.7 High	Mar 6, 2026

Other Red Hat products