9.3
Critical
CVE-2026-66794 A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes
Description
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| multicluster engine for Kubernetes 2.10 1787173361 | earliest → < 1787173361 | 1787173361 |
| multicluster engine for Kubernetes 2.11 1787276784 | earliest → < 1787276784 | 1787276784 |
| multicluster engine for Kubernetes 2.17 1786983349 | earliest → < 1786983349 | 1786983349 |
| multicluster engine for Kubernetes 2.6 1787275318 | earliest → < 1787275318 | 1787275318 |
| multicluster engine for Kubernetes 2.8 1787275519 | earliest → < 1787275519 | 1787275519 |
| multicluster engine for Kubernetes 2.9 1787274923 | earliest → < 1787274923 | 1787274923 |
| multicluster engine for Kubernetes 2.1 1787173361 | earliest → < 1787173361 | 1787173361 |
| multicluster engine for Kubernetes 2.9.0 1787274923 | earliest → < 1787274923 | 1787274923 |
| multicluster engine for Kubernetes 2.11.0 1787276784 | earliest → < 1787276784 | 1787276784 |
References
- RHSA-2026:59556 access.redhat.com
- RHSA-2026:59557 access.redhat.com
- RHSA-2026:59558 access.redhat.com
- RHSA-2026:59559 access.redhat.com
- RHSA-2026:59579 access.redhat.com
- RHSA-2026:59593 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2507539 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of multicluster engine for Kubernetes 2.10
The 46 CVEs of multicluster engine for Kubernetes 2.10 →
CVE-2026-73267
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE)
7.7
High
CVE-2026-75569
A flaw was found in mce-operator-bundle
7.7
High
CVE-2026-66795
A flaw was found in the managedcluster-import-controller
9.9
Critical
CVE-2026-73266
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE)
7.1
High