9.3
Critique
CVE-2026-66794 A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes
Description
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| multicluster engine for Kubernetes 2.10 1787173361 | premières → < 1787173361 | 1787173361 |
| multicluster engine for Kubernetes 2.11 1787276784 | premières → < 1787276784 | 1787276784 |
| multicluster engine for Kubernetes 2.17 1786983349 | premières → < 1786983349 | 1786983349 |
| multicluster engine for Kubernetes 2.6 1787275318 | premières → < 1787275318 | 1787275318 |
| multicluster engine for Kubernetes 2.8 1787275519 | premières → < 1787275519 | 1787275519 |
| multicluster engine for Kubernetes 2.9 1787274923 | premières → < 1787274923 | 1787274923 |
| multicluster engine for Kubernetes 2.1 1787173361 | premières → < 1787173361 | 1787173361 |
| multicluster engine for Kubernetes 2.9.0 1787274923 | premières → < 1787274923 | 1787274923 |
| multicluster engine for Kubernetes 2.11.0 1787276784 | premières → < 1787276784 | 1787276784 |
Références
- RHSA-2026:59556 access.redhat.com
- RHSA-2026:59557 access.redhat.com
- RHSA-2026:59558 access.redhat.com
- RHSA-2026:59559 access.redhat.com
- RHSA-2026:59579 access.redhat.com
- RHSA-2026:59593 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2507539 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de multicluster engine for Kubernetes 2.10
Les 46 CVE de multicluster engine for Kubernetes 2.10 →
CVE-2026-73267
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE)
7.7
Élevée
CVE-2026-75569
A flaw was found in mce-operator-bundle
7.7
Élevée
CVE-2026-66795
A flaw was found in the managedcluster-import-controller
9.9
Critique
CVE-2026-73266
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE)
7.1
Élevée