CVE-2026-27136 is a vulnerability in the golang.org/x/net/html package used by Red Hat Advanced Cluster Management for Kubernetes. When arbitrary HTML is parsed and rendered, it can produce an unexpected HTML tree that bypasses sanitization mechanisms, enabling Cross-Site Scripting (XSS) attacks. This flaw can lead to information disclosure or arbitrary code execution in affected applications. The vulnerability requires user interaction and is rated as Important by Red Hat with a CVSS v3 base score of 8.1. The Red Hat advisory provides updated container images in version 2.13.10 that address this and other security issues. The update is recommended to mitigate these risks.

Successful exploitation of CVE-2026-27136 can allow attackers to bypass HTML sanitization, resulting in Cross-Site Scripting (XSS) attacks. This may lead to disclosure of sensitive information such as user cookies and session data, or execution of arbitrary code in the context of the affected application. The vulnerability affects confidentiality and integrity but does not impact availability. Exploitation requires user interaction with crafted malicious HTML content. No known active exploits have been reported.

A security update is available in Red Hat Advanced Cluster Management for Kubernetes version 2.13.10, which includes fixes for CVE-2026-27136 and other vulnerabilities. Users should apply this update after ensuring all previously released relevant errata are installed. No alternative mitigations meeting Red Hat's criteria for ease of use and applicability are currently available. Refer to Red Hat's official documentation for update procedures.