CVE-2026-66795criticalCWE-295

CVE-2026-66795: falha crítica em Red Hat multicluster engine for Kubernetes 2.10

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar multicluster engine for Kubernetes

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.9epss 0.5%
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Red Hat · multicluster engine for Kubernetes 2.10Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.17Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9
CVEs relacionadas — Red Hat multicluster engine for Kubernetes 2.10

No mesmo produto, das mais perigosas para as menos.

CVE-2026-16242CRITICALHypershift: konnectivity proxy-server accepts agent connections without validating client certificatesEPSS 0.9%CVE-2026-73268CRITICALCluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionEPSS 0.9%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%CVE-2026-73267HIGHClusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkEPSS 0.6%CVE-2026-66794CRITICALCluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeEPSS 0.6%CVE-2026-75569HIGHMce-operator-bundle: all github actions pinned by mutable tag, not commit shaEPSS 0.6%