VDB
RHSA-2026%3A11858
RHSA-2026%3A11858
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:0c8cde2ce0d64f185f0c7fb53159cc16928ec405638f5c5432858f1d708f063d_ppc64le as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:0c8cde2ce0d64f185f0c7fb53159cc16928ec405638f5c5432858f1d708f063d_ppc64le, *, registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:0c8cde2ce0d64f185f0c7fb53159cc16928ec405638f5c5432858f1d708f063d_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:18c50cd66ff586d16329494871952959e2407b759fe129623d3a4d7903efec64_arm64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:18c50cd66ff586d16329494871952959e2407b759fe129623d3a4d7903efec64_arm64, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:5716627c8c363880f5ec32adcccf835edc98be2750dad798677b4ad578f1abec_s390x as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:5716627c8c363880f5ec32adcccf835edc98be2750dad798677b4ad578f1abec_s390x, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:5716627c8c363880f5ec32adcccf835edc98be2750dad798677b4ad578f1abec_s390x, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:5716627c8c363880f5ec32adcccf835edc98be2750dad798677b4ad578f1abec_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:21954a22577d53042393c0e06715e4c81a83cb7f957849a98a8047e9578ea34e_arm64 as a component of multicluster engine for Kubernetes 2.7 | *, registry.redhat.io/multicluster-engine/registration-rhel9@sha256:21954a22577d53042393c0e06715e4c81a83cb7f957849a98a8047e9578ea34e_arm64, registry.redhat.io/multicluster-engine/registration-rhel9@sha256:21954a22577d53042393c0e06715e4c81a83cb7f957849a98a8047e9578ea34e_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:02cd4a0df1b9ac62b962724fd0f296abd6a9e39f8e7349118f600db2e2c0800b_arm64 as a component of multicluster engine for Kubernetes 2.7 | *, *, * |
| Red Hat | multicluster engine for Kubernetes | |
| Red Hat | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:4b70482b46bbb0eccb9015a05890117edb82dd83ff86f1a6e81fe97bf030b9f4_amd64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:4b70482b46bbb0eccb9015a05890117edb82dd83ff86f1a6e81fe97bf030b9f4_amd64, registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:4b70482b46bbb0eccb9015a05890117edb82dd83ff86f1a6e81fe97bf030b9f4_amd64, * |
| Red Hat | registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:1ea30581d8013607d6ba364e41f5e440c253192380a713e2c05fe06a0d9b4c9d_ppc64le as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:1ea30581d8013607d6ba364e41f5e440c253192380a713e2c05fe06a0d9b4c9d_ppc64le, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/work-rhel9@sha256:ebae66245e3a43a3791ea3822126d3a6a0d0a7fffc5e1a1c511a453b5fed4922_amd64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/work-rhel9@sha256:ebae66245e3a43a3791ea3822126d3a6a0d0a7fffc5e1a1c511a453b5fed4922_amd64, registry.redhat.io/multicluster-engine/work-rhel9@sha256:ebae66245e3a43a3791ea3822126d3a6a0d0a7fffc5e1a1c511a453b5fed4922_amd64, registry.redhat.io/multicluster-engine/work-rhel9@sha256:ebae66245e3a43a3791ea3822126d3a6a0d0a7fffc5e1a1c511a453b5fed4922_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c2fed62eff877f89f7232c05afc75e90b13dd8c646edb12f8273856ca2bbbe22_arm64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c2fed62eff877f89f7232c05afc75e90b13dd8c646edb12f8273856ca2bbbe22_arm64, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c2fed62eff877f89f7232c05afc75e90b13dd8c646edb12f8273856ca2bbbe22_arm64, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c2fed62eff877f89f7232c05afc75e90b13dd8c646edb12f8273856ca2bbbe22_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:ae59e8f8ec60a6a60aafdff995bef8ef7d9747cff0e1259fcf39eb3a436963d1_ppc64le as a component of multicluster engine for Kubernetes 2.7 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:58bf37ac0d2607854112b13ecee022fcce0a2e9e4c757c63aecdcf15dfb436cc_s390x as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/hypershift-rhel9-operator@sha256:58bf37ac0d2607854112b13ecee022fcce0a2e9e4c757c63aecdcf15dfb436cc_s390x, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:27927ad330c942f758d3d60cc982ccc518a662bc06f18c1d322100ba688a8dda_arm64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:27927ad330c942f758d3d60cc982ccc518a662bc06f18c1d322100ba688a8dda_arm64, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:27927ad330c942f758d3d60cc982ccc518a662bc06f18c1d322100ba688a8dda_arm64, * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:a121232bfe7f29debd52946c4312266b8cf02b14e4751e352647626965d895b3_amd64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:a121232bfe7f29debd52946c4312266b8cf02b14e4751e352647626965d895b3_amd64, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:a121232bfe7f29debd52946c4312266b8cf02b14e4751e352647626965d895b3_amd64, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:a121232bfe7f29debd52946c4312266b8cf02b14e4751e352647626965d895b3_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:56de47cb4bc821a46d0902ebc5f23ecff272fb5d994e580df7338c9a066a28a9_amd64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:56de47cb4bc821a46d0902ebc5f23ecff272fb5d994e580df7338c9a066a28a9_amd64, registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:56de47cb4bc821a46d0902ebc5f23ecff272fb5d994e580df7338c9a066a28a9_amd64, registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:56de47cb4bc821a46d0902ebc5f23ecff272fb5d994e580df7338c9a066a28a9_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:e42083663ae861a57ee5b402655051e8a20ae1199767d238032debe473b6310b_amd64 as a component of multicluster engine for Kubernetes 2.7 | *, registry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:e42083663ae861a57ee5b402655051e8a20ae1199767d238032debe473b6310b_amd64, * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:123b2b2140a47e05c14137b14116b38e3054f99ff615f56ad0fb59a0fe480325_s390x as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:123b2b2140a47e05c14137b14116b38e3054f99ff615f56ad0fb59a0fe480325_s390x, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:60ea7b6c03d1271aa661e1fdb85a896c39932754515a3a14e6fe0ff65ed9bcd1_arm64 as a component of multicluster engine for Kubernetes 2.7 | *, registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:60ea7b6c03d1271aa661e1fdb85a896c39932754515a3a14e6fe0ff65ed9bcd1_arm64, registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:60ea7b6c03d1271aa661e1fdb85a896c39932754515a3a14e6fe0ff65ed9bcd1_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:07c4ab11ef079cb9126d434b16957a8a34544941bee4a652571bd1629c7ac0d7_amd64 as a component of multicluster engine for Kubernetes 2.7 | registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:07c4ab11ef079cb9126d434b16957a8a34544941bee4a652571bd1629c7ac0d7_amd64, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:d3c2d36cd5e18c49a8d54c70bcd74b11746016b269e7dd67a90b5cc302f4ca50_ppc64le as a component of multicluster engine for Kubernetes 2.7 | *, *, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:d3c2d36cd5e18c49a8d54c70bcd74b11746016b269e7dd67a90b5cc302f4ca50_ppc64le |
…and 90 more
Timeline
- Apr 29, 2026 CVE Published
- May 5, 2026 Distribution Patch
- May 5, 2026 Distribution Patch
- May 5, 2026 Security Advisory
- May 5, 2026 Security Advisory
- Jun 3, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:11858 advisory
- https://access.redhat.com/security/cve/CVE-2026-29063 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11858.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445291 issue
- https://www.cve.org/CVERecord?id=CVE-2026-29063 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-29063 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 advisory
- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw advisory