VDB

RHSA-2026:57194

RHSA-2026:57194 PUBLISHED CVSS 8.699999809265137 HIGH

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to `a.com/` containing an Authorization header redirected to `b.com/` will not send that header to `b.com`. However, the sensitive headers would be restored if the client received a subsequent same-domain redirect. For example, a chain of redirects from `a.com/`, to `b.com/1`, and finally to `b.com/2` would incorrectly send the Authorization header to `b.com/2`.

Risk Scores

CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatregistry.redhat.io/multicluster-engine/discovery-rhel9@sha256:43850784416ed4c8ff8c41eb71382a4a4afb7804d57da0a151e9d90a30fc17e2_arm64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9936fc094d8f146c079226319143b9ed209f5b7d345a130287aa5a10678aa887_arm64 as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9@sha256:449576503bf3eabb67a966a2656c7eb5bbb941175fd693b0a5e606b4b5b8ab28_ppc64le as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:634cb03d65158f1b2364d10ac4a29c01c413d1c35d6c4768c28ae196710cf5be_amd64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9@sha256:a143d59ea8dba9a4a465becd9be1ca84674d61ca270be8dc01beeba9a69d5df8_amd64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/multicloud-manager-rhel9@sha256:cab4332752f21cec3d996525997b0cdcc34ab0841dde15593f71f19ca3c12b09_ppc64le as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/provider-credential-controller-rhel9@sha256:5ed9d10c8fe8418800b02da0284bbf421b1d29f5efe0ae09da3ea7108f9af6f5_amd64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:e5faa2640041002b8acbc6e9be67485a13c2f62ba4ad6c42793e1c485b49169e_arm64 as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:a3df25b5b7f5a12e15a403223cc97d506c527f8abaaf832a27cd895cb1707888_amd64 as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:8e70b290d28ca557ebb6e859a601b0c59eae41c689ac63e240ee0b450eb56aa7_ppc64le as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5d1316e7dd1a4dd0c7f3253e5c131c6c5ea7c75a3796448675c98572601d6ea5_arm64 as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:9613f5fceb8a35f6efafaa84f1f67ed032b11363f836e5298026368ccaa1726f_arm64 as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/registration-rhel9@sha256:55c7ed6f934c9d0ed61e529cada40c3b2565cca593d55d93ac3d89e0655c92e9_arm64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/work-rhel9@sha256:7bd1843f74e98c3e113274679f6040a2d18f4f992802524bf69af58c0a25a24f_ppc64le as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/managed-serviceaccount-rhel9@sha256:3fd3997fee2926a26c09fa5f8817aae7b076650b083d5084fb3a53e57351a8ad_amd64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:5acf929f44e14e1a1d229e0a4d0e0d68c592654435d0a7ea234c23d88e7da686_s390x as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/clusterlifecycle-state-metrics-rhel9@sha256:5d1316e7dd1a4dd0c7f3253e5c131c6c5ea7c75a3796448675c98572601d6ea5_arm64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/console-mce-rhel9@sha256:a076ba3192b7408fdb8484225d3591be134c95bdf8182095e62e83eb46289435_amd64 as a component of multicluster engine for Kubernetes 2.11*, *, *
Red Hatregistry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:126a79bee08f4df0f9dc8327e479768c1066fddad4359416935414933a190556_s390x as a component of multicluster engine for Kubernetes 2.11.0*
Red Hatregistry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:b0a0f8badd1af9ba8a0265c9901910ac305b1a0b62b62ac76b4dd843c30c0f3b_s390x as a component of multicluster engine for Kubernetes 2.11*, *, *

…and 236 more

Timeline

  • Aug 19, 2026 CVE Published
  • Sep 22, 2026 CVE Updated
  • Sep 22, 2026 Distribution Patch
  • Sep 22, 2026 Distribution Patch
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory
  • Sep 22, 2026 Security Advisory

References

…and 293 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›