CVE-2026-32285VulnerabilityPublished 13 May 2026Updated 30 Oct 2026

Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.8.6

Affects Red HatSource GCVE Database

Compare

Not known to be exploited : upgrade Red Hat to 2.10.3 or 2.8.6 soon.

Data as of 30 Oct 2026, 11:52 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.10.3, 2.8.6

Exploitation evidence

Disclosed: evidence found.
CVE published 13 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Red Hat to 2.10.3 or 2.8.6.

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected >=2.0.0 <2.8.6 >=2.8 <2.10.3 Red Hat multicluster engine for Kubernetes multicluster engine for Kubernetes 2.8 amd64 registry.redhat.io/multicluster-engine/assisted-service-8-rhel8@sha256:5c3fb43dee6299526b4c48d8a4c0a551ce138ff468bec663a29b7f174f4f2d9d_amd64 registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:649bcd0409be091c4408aaebb217815f052a3a0f3028f60888de8807e9107873_amd64 multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/assisted-image-service-rhel9@sha256:975b240b2e2f7eb955bd06acf36a9e3a4da8dbeb579ec23fb855da954c4ed46d_amd64 Red Hat Hardened Images aarch64 syft-main@aarch64 multicluster engine for Kubernetes 2.1	Fixed in 2.8.6 2.10.3

AI-suggested

Red Hat states that mitigation options either do not exist or do not meet their criteria for deployment due to complexity or stability concerns. Customers with a Red Hat Technical Account Manager (TAM) can discuss this vulnerability directly with Red Hat for tailored guidance.

Description

Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.10.3 release that simplify the process of deploying OpenShift Container Platform clusters. The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters, or to import existing Kubernetes-based clusters for management. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

Impact

The impact of this vulnerability is a denial of service caused by a runtime panic in the jsonparser library when processing malformed JSON input. This can disrupt the availability of the multicluster engine for Kubernetes and the Assisted Installer components that rely on it, potentially affecting centralized management of Kubernetes clusters. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Summary

The vulnerability identified as CVE-2026-32285 affects the github.com/buger/jsonparser library used in Red Hat's multicluster engine for Kubernetes 2.8.6 and related Assisted Installer RHEL 9 components. Specifically, the Delete function fails to properly validate offsets when handling malformed JSON input, leading to a negative slice index and a runtime panic. This can be exploited remotely by an attacker supplying specially crafted JSON data to cause a denial of service (DoS) condition. Red Hat has not provided an official patch or fix for this issue, citing lack of suitable mitigation options that meet their criteria for ease of use, applicability, and stability. The advisory references multiple CVEs related to this issue and provides documentation links for the affected products. The vulnerability is classified under CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input).

CWE-1285Improper Validation of Specified Index, Position, or Offset in Input (opens in a new tab)
Base weakness
The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not correctly calculate the size to be used when allocating a buffer.
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Attack patterns
Overflow Buffers (opens in a new tab)
Buffer Overflow via Parameter Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Requirements
Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
Architecture and Design
Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.
Architecture and Design
Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V8.1.4 (opens in a new tab)
V13.4.1 (opens in a new tab)
V11.1.4 (opens in a new tab)
Attack patterns
XML Ping of the Death (opens in a new tab)
Exponential Data Expansion (opens in a new tab)
Serialized Data Parameter Blowup (opens in a new tab)
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)
Base weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 19:16 UTC

WeaknessesCWE-1285, CWE-131, CWE-770 +1

Technical details

References

Community reviews

Related threats