CVE-2026-17107highCWE-441

CVE-2026-17107: high-severity vulnerability in Red Hat multicluster engine for Kubernetes 2.10

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

Published · Updated

Follow this CVE+ Monitor multicluster engine for Kubernetes

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.6%
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Red Hat · multicluster engine for Kubernetes 2.10Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.17Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9
Related CVEs — Red Hat multicluster engine for Kubernetes 2.10

In the same product, most dangerous first.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2026-73268CRITICALCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionEPSS 0.9%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%CVE-2026-66794CRITICALCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeEPSS 0.6%CVE-2026-75569HIGHMce-operator-bundle: all github actions pinned by mutable tag, not commit shaEPSS 0.6%