RHSA-2026:54432 | Vulnetix

RHSA-2026:54432 PUBLISHED CVSS 8.699999809265137 HIGH

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.

Risk Scores

CVSS 3.1

8.699999809265137

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9@sha256:781d0353b3be35233a3aa6d00b7735028e8fcd79333f4c62e37cbdcf4133e84b_amd64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/placement-rhel9@sha256:df9ff018f6bd33041f426329cac6e14e4468282df52ee475b755d5d8710f56cd_ppc64le as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:cf91259c470d2b91c3bca9e6da4708e36d6b159041980fb1d8d8b682fc19483e_ppc64le as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:135cb77ac83e5349d88f9a8515d0beb346d8e1c9efb3c600b334426702927e90_arm64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:db274fe9e0f62ff5dd5234d6f53253abfbeb0504ba20f9e4cc71e751ec3defda_ppc64le as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:dbe55cb7c87224ae10d5b157ef5e66a4ffe4788bfb134a3db47d2c1bceab4eec_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:65ce5e3bde238d14a0cbca9425fb399f27fcef82a21120fff7a6676f783dc4ed_arm64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:6fdfb1894d8b5579119a50b2f1158055a5a60ada8a3e30528d0ef47616853da3_arm64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:4a6ef79ffa40e508257f84a88784b5facb0f3c08f029821b214a3547ed4fc01e_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:aa964bc0245cd01f2077b2f28567048ccb638cb899eefa66383dbcc2d53bcf3d_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:943a236140644ce9c67569c2fd5e82895cd8230bd7bc606073ed3d337f04a6db_ppc64le as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/discovery-rhel9@sha256:80dca985b841d0db3ea0cf163c25a105c249ecd511f35935b1c86404a24cc73a_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:4de85fb645c49673a188cf16d9c5f60f6c22165f2c17d9d9575a261156895628_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:7a4f789a2052262a7b2ed37fa62f7f9d9c747234be0de055d79a8a0ca4b6107b_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5cfefcf34e2b6aaa3007aa6e23833ec6bf807fcc917068fb20dd2d24ad928ebc_ppc64le as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:b4dba38a06b90ec9a88ba2541429cd19d2a03588944045a5c0c4c33988329d07_arm64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/registration-operator-rhel9@sha256:ef81436e20db8fe798430f1694c6234d5583b1b97e1a689450c9e795de353563_amd64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:9f3ea1ff54dee0a230a1129a31b8b50afb8bed5601401c6e28a3faa5d7327643_s390x as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:5a866383d9f4977b85ce3a46e4c3d05f6ad3bc3f46a3a3749ac3dda69c99fe0e_arm64 as a component of multicluster engine for Kubernetes 2.10	*
Red Hat	registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:09caff77bc08c100f903b69998dd30347d79f0a0aed7ac245e3194838ecd4752_arm64 as a component of multicluster engine for Kubernetes 2.10	*

…and 104 more

Timeline

Aug 12, 2026 CVE Published
Sep 2, 2026 CVE Updated
Sep 2, 2026 Distribution Patch
Sep 2, 2026 Distribution Patch
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory
Sep 2, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:54432 advisory
https://access.redhat.com/security/cve/CVE-2024-45336 advisory
https://access.redhat.com/security/cve/CVE-2025-22866 advisory
https://access.redhat.com/security/cve/CVE-2026-27145 advisory
https://access.redhat.com/security/cve/CVE-2026-39829 advisory
https://access.redhat.com/security/cve/CVE-2026-39831 advisory
https://access.redhat.com/security/cve/CVE-2026-46597 advisory
https://access.redhat.com/security/cve/CVE-2026-66805 advisory
https://access.redhat.com/security/cve/CVE-2026-66808 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54432.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2341751 issue
https://www.cve.org/CVERecord?id=CVE-2024-45336 advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-45336 advisory
https://github.com/golang/go/issues/70530 advisory
https://groups.google.com/g/golang-announce/c/sSaUhLA-2SI advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2344219 issue
https://www.cve.org/CVERecord?id=CVE-2025-22866 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-22866 advisory
https://go.dev/cl/643735 advisory

…and 38 more

Open in Interactive Console →