The Red Hat Assisted Installer RHEL 8 components for the Multicluster Engine for Kubernetes 2.9.4 release include vulnerabilities identified as CVE-2026-7163 and CVE-2026-34986. These vulnerabilities relate to improper handling of sensitive information and buffer size calculations (CWE-312 and CWE-131). The multicluster engine is designed to centrally manage multiple Kubernetes clusters across various environments and provides APIs for configuration management. The advisory does not provide patches or fixes at this time but references documentation for installation and usage. The vulnerabilities affect the container images used by the assisted-service component for multiple architectures. No known exploits in the wild have been reported.

The vulnerabilities could potentially allow exposure of sensitive information due to cleartext storage (CWE-312) and may cause issues related to buffer size miscalculations (CWE-131), which could lead to memory corruption or denial of service. Given the high severity rating, these issues may impact the security and stability of the multicluster engine used for managing Kubernetes clusters. However, no known exploits in the wild have been reported, and no direct impact scenarios are detailed in the advisory.

The vendor advisory does not currently provide any patches or fixes for these vulnerabilities. Users should monitor Red Hat's official security advisories for updates and apply any future patches promptly. Refer to the official Red Hat documentation for proper installation and configuration of the multicluster engine components. No specific mitigation steps are indicated in the advisory at this time.