The Red Hat Assisted Installer for RHEL 8 includes components for the multicluster engine for Kubernetes 2.8.8, which supports centralized management of Kubernetes clusters across various environments. This advisory identifies two vulnerabilities (CVE-2025-58058 and CVE-2026-39883) affecting these components. The vulnerabilities are associated with CWEs 770 (Allocation of Resources Without Limits or Throttling) and 426 (Untrusted Search Path), indicating potential issues in resource management and path handling. The advisory does not provide detailed technical exploitation information or confirm active exploits. No patches or fixes have been released as of the advisory date.

The vulnerabilities potentially affect the Assisted Installer components for the multicluster engine, which could impact the deployment and management of OpenShift Container Platform clusters. Given the involvement of resource allocation and untrusted search path weaknesses, there may be risks related to improper resource control or execution of unintended code paths. However, no known exploits in the wild have been reported, and the advisory does not specify direct impact scenarios or confirmed exploitation.

No official fixes or patches are currently available for these vulnerabilities. Users should monitor Red Hat's official advisories and documentation for updates regarding remediation. The advisory provides links to documentation for the Assisted Installer and multicluster engine but does not specify any immediate mitigation steps or workarounds. Organizations should follow Red Hat's guidance and update components once patches are released.