VDB
RHSA-2026%3A11414
RHSA-2026%3A11414
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e0fecd29a27d2b0498c2e08984f027a11fca5a4df71518ecce69163040e7bd52_arm64 as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e0fecd29a27d2b0498c2e08984f027a11fca5a4df71518ecce69163040e7bd52_arm64, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e0fecd29a27d2b0498c2e08984f027a11fca5a4df71518ecce69163040e7bd52_arm64, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:e0fecd29a27d2b0498c2e08984f027a11fca5a4df71518ecce69163040e7bd52_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:528974c1030f74c174e02c0168ff4caed438bdbe6a028dd4b2b621c60316a32c_ppc64le as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:528974c1030f74c174e02c0168ff4caed438bdbe6a028dd4b2b621c60316a32c_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:0d311a96d10861ed390004216ef1ab7af16069752f93672a60a213d8a2352062_s390x as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:0d311a96d10861ed390004216ef1ab7af16069752f93672a60a213d8a2352062_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:14aa8aca2295a7b53bcb953b0af416922e6052613805d7a798626c01356e39ee_s390x as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:b87122a23230b1f662b072ad8a7b2c7ad1a71eac5c98c24d36c0c4f39757118f_amd64 as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:b87122a23230b1f662b072ad8a7b2c7ad1a71eac5c98c24d36c0c4f39757118f_amd64, registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:b87122a23230b1f662b072ad8a7b2c7ad1a71eac5c98c24d36c0c4f39757118f_amd64, * |
| Red Hat | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:e25abca08356e40db5cf41975adaf1504272f2746c06ac1f6e55a704e1785d7b_ppc64le as a component of multicluster engine for Kubernetes 2.9 | *, *, registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:e25abca08356e40db5cf41975adaf1504272f2746c06ac1f6e55a704e1785d7b_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:0b014d18915c87a519d991c5a5e3d4af8759f5d3c27dd3bdf03cd0def03288f6_ppc64le as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:0b014d18915c87a519d991c5a5e3d4af8759f5d3c27dd3bdf03cd0def03288f6_ppc64le, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:8e91dabc89b2b2f09898197df3dbdc10f8ba6fe1fc98633c3f5cd03154f40b6b_amd64 as a component of multicluster engine for Kubernetes 2.9 | *, registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:8e91dabc89b2b2f09898197df3dbdc10f8ba6fe1fc98633c3f5cd03154f40b6b_amd64, * |
| Red Hat | registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:cafdfbb755b27bb88f7c8f69421c9f072e9ac24d2509aa0209c2520d7290d7ff_amd64 as a component of multicluster engine for Kubernetes 2.9 | *, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:cafdfbb755b27bb88f7c8f69421c9f072e9ac24d2509aa0209c2520d7290d7ff_amd64, * |
| Red Hat | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:e25abca08356e40db5cf41975adaf1504272f2746c06ac1f6e55a704e1785d7b_ppc64le as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/mce-capi-webhook-config-rhel9@sha256:7f2448dc107a905cfd63f4a8839f360cf5891b4c626311d3f97aa235e0087ffe_s390x as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/mce-capi-webhook-config-rhel9@sha256:7f2448dc107a905cfd63f4a8839f360cf5891b4c626311d3f97aa235e0087ffe_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:09e87dd1e6016e48c530fb4647ae9aba19d3826a01742081484d7fe285dad195_s390x as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:09e87dd1e6016e48c530fb4647ae9aba19d3826a01742081484d7fe285dad195_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:af2aa3efb5259ea254779c26501bf5880d8cf019b7801bc634265cfbab80d7b9_ppc64le as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:af2aa3efb5259ea254779c26501bf5880d8cf019b7801bc634265cfbab80d7b9_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:b508a3c16e643ab9515101d3eca74c8d0857170407deb5a34154c144338ac925_s390x as a component of multicluster engine for Kubernetes 2.9 | *, registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:b508a3c16e643ab9515101d3eca74c8d0857170407deb5a34154c144338ac925_s390x, * |
| Red Hat | registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:c270573ea1330770d49931576be3806fab588071645e2ba7c66650eaa6732f63_arm64 as a component of multicluster engine for Kubernetes 2.9 | *, registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:c270573ea1330770d49931576be3806fab588071645e2ba7c66650eaa6732f63_arm64, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:0482f136aea57d0c58833fbf0c9b98a78e12750cc12a4f76c6da35b2578bcb66_ppc64le as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:20ed9b44900139c7c716d27db8c13e320517f5bc0e035178e5ec21830aedf9d1_s390x as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:a7c3a67560df6ab9d03ba9419a6f47ff3132e3427df42663c5fddcaa51e63636_amd64 as a component of multicluster engine for Kubernetes 2.9 | * |
| Red Hat | registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:45d6d4b3ec7dd3b796886befd058be7b705eba7beb3b4306854236ab2b085b76_s390x as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:45d6d4b3ec7dd3b796886befd058be7b705eba7beb3b4306854236ab2b085b76_s390x, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:25c76d4483c27911edae51f48471299531523b9b7da53fc55b57cee07c5aafbf_amd64 as a component of multicluster engine for Kubernetes 2.9 | registry.redhat.io/multicluster-engine/placement-rhel9@sha256:25c76d4483c27911edae51f48471299531523b9b7da53fc55b57cee07c5aafbf_amd64, registry.redhat.io/multicluster-engine/placement-rhel9@sha256:25c76d4483c27911edae51f48471299531523b9b7da53fc55b57cee07c5aafbf_amd64, registry.redhat.io/multicluster-engine/placement-rhel9@sha256:25c76d4483c27911edae51f48471299531523b9b7da53fc55b57cee07c5aafbf_amd64 |
…and 225 more
Timeline
- Apr 28, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Jun 5, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:11414 advisory
- https://access.redhat.com/security/cve/CVE-2025-13465 advisory
- https://access.redhat.com/security/cve/CVE-2025-61726 advisory
- https://access.redhat.com/security/cve/CVE-2025-68121 advisory
- https://access.redhat.com/security/cve/CVE-2026-25639 advisory
- https://access.redhat.com/security/cve/CVE-2026-29063 advisory
- https://access.redhat.com/security/cve/CVE-2026-40175 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11414.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2434432 issue
- https://www.cve.org/CVERecord?id=CVE-2025-61726 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-61726 advisory
- https://go.dev/cl/736712 advisory
- https://go.dev/issue/77101 advisory
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc advisory
…and 28 more