CVE-2025-47907 is a race condition vulnerability in the database/sql package used by the multicluster engine for Kubernetes. When a query is cancelled during a Scan method call on returned Rows, concurrent queries can produce unexpected and inconsistent results due to improper synchronization. This flaw can be triggered by an attacker able to initiate and cancel queries, potentially causing inconsistent data to be returned to the application. The vulnerability is marked as moderate severity by Red Hat, with limited exploitation scope and unlikely to cause direct compromise in typical deployments. The issue affects versions >=2.10.0 and <2.10.1 of the multicluster engine for Kubernetes. Red Hat has published advisory RHSA-2026:1071 and recommends upgrading to version 2.10.1.

The vulnerability can cause inconsistent data to be returned to applications using the multicluster engine for Kubernetes when queries are cancelled concurrently. This may lead to unexpected application behavior but is unlikely to result in direct system compromise. The race condition could also cause resource consumption issues or instability in rare cases. There are no known exploits in the wild. The impact is rated medium severity by Red Hat.

Red Hat has released version 2.10.1 of the multicluster engine for Kubernetes which addresses this vulnerability. Users should upgrade to version 2.10.1 or later to remediate the issue. No additional mitigations are specified or required beyond applying the official update.