7.7
Élevée
CVE-2026-75569 A flaw was found in mce-operator-bundle
Description
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| multicluster engine for Kubernetes 2.10 1787263075 | premières → < 1787263075 | 1787263075 |
| multicluster engine for Kubernetes 2.11 1787321579 | premières → < 1787321579 | 1787321579 |
| multicluster engine for Kubernetes 2.17 1787083639 | premières → < 1787083639 | 1787083639 |
| multicluster engine for Kubernetes 2.6 1787317415 | premières → < 1787317415 | 1787317415 |
| multicluster engine for Kubernetes 2.8 1787318262 | premières → < 1787318262 | 1787318262 |
| multicluster engine for Kubernetes 2.9 1787287150 | premières → < 1787287150 | 1787287150 |
| multicluster engine for Kubernetes 2.1 1787263075 | premières → < 1787263075 | 1787263075 |
| multicluster engine for Kubernetes 2.11.0 1787321579 | premières → < 1787321579 | 1787321579 |
| multicluster engine for Kubernetes 2.9.0 1787287150 | premières → < 1787287150 | 1787287150 |
Références
- RHSA-2026:59634 access.redhat.com
- RHSA-2026:59636 access.redhat.com
- RHSA-2026:59637 access.redhat.com
- RHSA-2026:59638 access.redhat.com
- RHSA-2026:59642 access.redhat.com
- RHSA-2026:59643 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2519849 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de multicluster engine for Kubernetes 2.10
Les 46 CVE de multicluster engine for Kubernetes 2.10 →
CVE-2026-73267
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE)
7.7
Élevée
CVE-2026-66794
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes
9.3
Critique
CVE-2026-66795
A flaw was found in the managedcluster-import-controller
9.9
Critique
CVE-2026-73266
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE)
7.1
Élevée