The multicluster engine for Kubernetes versions 2.8.0 through 2.8.8 include a vulnerability in the golang.org/x/crypto/ssh/agent library used by SSH Agent servers. This vulnerability (CVE-2025-47914) arises because the SSH Agent server does not properly validate the size of incoming messages during new identity requests. A specially crafted malformed message can trigger an out-of-bounds read, causing the program to panic and terminate, resulting in a denial of service. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and has a Red Hat CVSS v3 base score of 5.3, indicating moderate severity. No active exploits are known in the wild, and Red Hat has not yet released a patch or fix for this issue.

An attacker can remotely cause a denial of service by crashing the SSH Agent server component within the multicluster engine for Kubernetes. This results in service interruption due to the program panic triggered by out-of-bounds memory reads. There is no direct impact on confidentiality or integrity reported. The vulnerability could potentially expose memory contents during the out-of-bounds read, but the primary impact is availability degradation.

Currently, no official fix or patch is available for this vulnerability in the affected versions of the multicluster engine for Kubernetes. Users should monitor Red Hat advisories for updates and consider upgrading to future versions once a fix is released. In the meantime, restricting access to the SSH Agent server component and limiting exposure to untrusted networks may reduce risk. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Check the vendor advisory regularly for remediation updates.