Skip to content
fr Sign in
5.8 Medium

CVE-2026-19130 A flaw was found in the provider-credential-controller component of multicluster-engine (MCE)

Description

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

Affected products and versions

Product Affected versions Fixed in
Multicluster Engine for Kubernetes Versions not published
multicluster engine for Kubernetes 2.10 1787176886 earliest → < 1787176886 1787176886
multicluster engine for Kubernetes 2.11 1787239595 earliest → < 1787239595 1787239595
multicluster engine for Kubernetes 2.17 1786664288 earliest → < 1786664288 1786664288
multicluster engine for Kubernetes 2.6 1787260821 earliest → < 1787260821 1787260821
multicluster engine for Kubernetes 2.8 1787259099 earliest → < 1787259099 1787259099
multicluster engine for Kubernetes 2.9 1787176716 earliest → < 1787176716 1787176716
multicluster engine for Kubernetes 2.1 1787176886 earliest → < 1787176886 1787176886
multicluster engine for Kubernetes 2.9.0 1787176716 earliest → < 1787176716 1787176716

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Multicluster Engine for Kubernetes

The 79 CVEs of Multicluster Engine for Kubernetes →
CVE-2026-114406 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 6.8 Medium CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… 3.3 Low CVE-2026-71297 A flaw was found in the maestro gRPC broker 5.4 Medium CVE-2026-71299 A flaw was found in Maestro 6.5 Medium
Track this CVE