Skip to content
fr Sign in
7.7 High

CVE-2026-75569 A flaw was found in mce-operator-bundle

Description

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

Affected products and versions

Product Affected versions Fixed in
multicluster engine for Kubernetes 2.10 1787263075 earliest → < 1787263075 1787263075
multicluster engine for Kubernetes 2.11 1787321579 earliest → < 1787321579 1787321579
multicluster engine for Kubernetes 2.17 1787083639 earliest → < 1787083639 1787083639
multicluster engine for Kubernetes 2.6 1787317415 earliest → < 1787317415 1787317415
multicluster engine for Kubernetes 2.8 1787318262 earliest → < 1787318262 1787318262
multicluster engine for Kubernetes 2.9 1787287150 earliest → < 1787287150 1787287150
multicluster engine for Kubernetes 2.1 1787263075 earliest → < 1787263075 1787263075
multicluster engine for Kubernetes 2.11.0 1787321579 earliest → < 1787321579 1787321579
multicluster engine for Kubernetes 2.9.0 1787287150 earliest → < 1787287150 1787287150

References

Timeline

  1. Published
  2. Last modified

Other CVEs of multicluster engine for Kubernetes 2.10

The 46 CVEs of multicluster engine for Kubernetes 2.10 →
CVE-2026-73267 A flaw was found in the clusterclaims-controller component of multicluster engine (MCE) 7.7 High CVE-2026-66794 A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes 9.3 Critical CVE-2026-66795 A flaw was found in the managedcluster-import-controller 9.9 Critical CVE-2026-73266 A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE) 7.1 High
Track this CVE