VDB
RHSA-2026%3A13847
RHSA-2026%3A13847
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ce60f32106581ab87d582707d506e2209ae63a32adb0dc6a2d2fed4e2ac44f75_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ce60f32106581ab87d582707d506e2209ae63a32adb0dc6a2d2fed4e2ac44f75_amd64, *, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:ce60f32106581ab87d582707d506e2209ae63a32adb0dc6a2d2fed4e2ac44f75_amd64 |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-application-rhel9@sha256:121c1e5d77d8250c49e5a1e2e42dfbd8736108be6d95f841404bed74c902e8ae_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/multicluster-operators-application-rhel9@sha256:121c1e5d77d8250c49e5a1e2e42dfbd8736108be6d95f841404bed74c902e8ae_ppc64le, * |
| Red Hat | registry.redhat.io/rhacm2/insights-client-rhel9@sha256:4f7ba9b4def4660cbed551c0682f281bb11f357097d8b7f3621fc12356f8158e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/insights-client-rhel9@sha256:4f7ba9b4def4660cbed551c0682f281bb11f357097d8b7f3621fc12356f8158e_s390x, *, * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:8f6af27ce50f82e6c4ec416e103950b7cd4f23db5b1762d7a26d1ff7de61cafe_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:8f6af27ce50f82e6c4ec416e103950b7cd4f23db5b1762d7a26d1ff7de61cafe_ppc64le, * |
| Red Hat | registry.redhat.io/rhacm2/obo-prometheus-rhel9-operator@sha256:0ac9fedad6caee4a7dd43202b0395826e0a4b6ccb2b0c213c02e035a5c5414b3_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/obo-prometheus-rhel9-operator@sha256:0ac9fedad6caee4a7dd43202b0395826e0a4b6ccb2b0c213c02e035a5c5414b3_arm64, * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-rhel9@sha256:e05262da686f4b1e72b49c53ded84c7d4abd2b2c14efeeccacd475484d602f7d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/acm-search-v2-rhel9@sha256:e05262da686f4b1e72b49c53ded84c7d4abd2b2c14efeeccacd475484d602f7d_amd64, *, * |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:27235e61068502356d00f852d730e25b217109ef1ca34ef092e7017addfcb324_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:27235e61068502356d00f852d730e25b217109ef1ca34ef092e7017addfcb324_amd64, registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:27235e61068502356d00f852d730e25b217109ef1ca34ef092e7017addfcb324_amd64, registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:27235e61068502356d00f852d730e25b217109ef1ca34ef092e7017addfcb324_amd64 |
| Red Hat | registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:ed32f0fbe59e4f84ccd3f44055b82988a3726c38b06a2b4d9a6a7f70e0e5a74c_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:ed32f0fbe59e4f84ccd3f44055b82988a3726c38b06a2b4d9a6a7f70e0e5a74c_arm64, registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:ed32f0fbe59e4f84ccd3f44055b82988a3726c38b06a2b4d9a6a7f70e0e5a74c_arm64 |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:7c72d0b720ca0eec14ef4aa65d4cc0c7427275e02cb7d104946265287947911d_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:7c72d0b720ca0eec14ef4aa65d4cc0c7427275e02cb7d104946265287947911d_amd64, *, registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:7c72d0b720ca0eec14ef4aa65d4cc0c7427275e02cb7d104946265287947911d_amd64 |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:a72fdf7d0372a72427aa0a6e8b109f16b8a9f85fb95eb65e440ab0b54be400b9_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, *, * |
| Red Hat | registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:b16797319f2f9906149da179accde07ed5924cd87e019a11aae38556beff89f8_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:b16797319f2f9906149da179accde07ed5924cd87e019a11aae38556beff89f8_ppc64le, registry.redhat.io/rhacm2/acm-volsync-addon-controller-rhel9@sha256:b16797319f2f9906149da179accde07ed5924cd87e019a11aae38556beff89f8_ppc64le, * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:a240acb963ecce70987efcf16e7f7eaf66f788054dd05a6217621b9a762202f8_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:a240acb963ecce70987efcf16e7f7eaf66f788054dd05a6217621b9a762202f8_arm64, *, registry.redhat.io/rhacm2/multicluster-operators-channel-rhel9@sha256:a240acb963ecce70987efcf16e7f7eaf66f788054dd05a6217621b9a762202f8_arm64 |
| Red Hat | registry.redhat.io/rhacm2/insights-client-rhel9@sha256:553459da478ef95963941b9358979bfbb3c68997278ca9cd67b6a3ca355e3675_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/insights-client-rhel9@sha256:553459da478ef95963941b9358979bfbb3c68997278ca9cd67b6a3ca355e3675_amd64, registry.redhat.io/rhacm2/insights-client-rhel9@sha256:553459da478ef95963941b9358979bfbb3c68997278ca9cd67b6a3ca355e3675_amd64 |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:9bf6418d8fbdbe0a981d4cee16b43c4fe24d3a6123227b5b3c66fb0a2d741bcf_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:9bf6418d8fbdbe0a981d4cee16b43c4fe24d3a6123227b5b3c66fb0a2d741bcf_s390x, * |
| Red Hat | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:c96cf5f414b3f48ec248ef7c5a9e2cf9c0443cd3d95bcb20e023977e495c315a_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:c96cf5f414b3f48ec248ef7c5a9e2cf9c0443cd3d95bcb20e023977e495c315a_arm64, registry.redhat.io/rhacm2/observatorium-rhel9-operator@sha256:c96cf5f414b3f48ec248ef7c5a9e2cf9c0443cd3d95bcb20e023977e495c315a_arm64, * |
| Red Hat | registry.redhat.io/rhacm2/memcached-exporter-rhel9@sha256:266e3bc744255b7423a852bfe9f2aa2ff3499bcda828bf6f10cd53c6ed60f458_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, *, * |
| Red Hat | registry.redhat.io/rhacm2/metrics-collector-rhel9@sha256:dbff781b6d02ab547a0861101ba8bf9a17051e306e0076468fa74fedec731a59_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | *, *, * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:962a967cab6ba3b98612c58568fc04df993d1da089861b51a8ab9da1fda6c56c_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:962a967cab6ba3b98612c58568fc04df993d1da089861b51a8ab9da1fda6c56c_s390x, *, * |
| Red Hat | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:e740d42ca99e7425a7bf954ecf233005fcf4c2f3f7690a29e05b085ae3fa67e0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:e740d42ca99e7425a7bf954ecf233005fcf4c2f3f7690a29e05b085ae3fa67e0_amd64, *, registry.redhat.io/rhacm2/multicloud-integrations-rhel9@sha256:e740d42ca99e7425a7bf954ecf233005fcf4c2f3f7690a29e05b085ae3fa67e0_amd64 |
| Red Hat | registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:2678b2e05d42b275bf2a4fa733c0a3f80ad8768844dd6dbc040248fef696411a_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:2678b2e05d42b275bf2a4fa733c0a3f80ad8768844dd6dbc040248fef696411a_ppc64le, registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:2678b2e05d42b275bf2a4fa733c0a3f80ad8768844dd6dbc040248fef696411a_ppc64le, registry.redhat.io/rhacm2/multiclusterhub-rhel9@sha256:2678b2e05d42b275bf2a4fa733c0a3f80ad8768844dd6dbc040248fef696411a_ppc64le |
…and 170 more
Timeline
- May 5, 2026 CVE Published
- May 6, 2026 Distribution Patch
- May 6, 2026 Distribution Patch
- May 6, 2026 Security Advisory
- May 6, 2026 Security Advisory
- Jun 3, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:13847 advisory
- https://access.redhat.com/security/cve/CVE-2026-29063 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13847.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445291 issue
- https://www.cve.org/CVERecord?id=CVE-2026-29063 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-29063 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 advisory
- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw advisory