multicluster engine vulnerabilities (CVE)

CVE records published for multicluster engine, newest first. Follow to get an email when a new one appears.

59 results

7.7High

CVE-2026-73267 2 months ago

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to spec…

7.7High

CVE-2026-75569 2 months ago

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remo…

9.3Critical

CVE-2026-66794 2 months ago

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL …

9.9Critical

CVE-2026-66795 2 months ago

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability all…

7.1High

CVE-2026-73266 2 months ago

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belongin…

5.8Medium

CVE-2026-19130 2 months ago

Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipul…

9.9Critical

CVE-2026-73268 2 months ago

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does…

9.9Critical

CVE-2026-73269 2 months ago

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privil…

9.1Critical

CVE-2026-10059 3 months ago

Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.6; Red Hat multicluster engine for Kubernetes 2.8

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant a…

8.5High

CVE-2026-17107 3 months ago

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

Red Hat multicluster engine for Kubernetes 2.10; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing ca…

9.4Critical

CVE-2026-16242 3 months ago

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17; Red Hat multicluster engine for Kubernetes 2.6

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote atta…

7.5High

CVE-2026-13676 4 months ago

fast-uri vulnerable to host confusion via failed IDN canonicalization

fast-uri fast-uri; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Enterprise Linux 10

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form…

9.3Critical

CVE-2026-44990 4 months ago

Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`

apostrophecms sanitize-html; Red Hat multicluster engine for Kubernetes 2.1; Red Hat multicluster engine for Kubernetes 2.11; Red Hat multicluster engine for Kubernetes 2.17

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a …

7.5High

CVE-2026-12143 4 months ago

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

form-data form-data; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage …

7.5High

CVE-2026-44486 4 months ago

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may ad…

8.2High

CVE-2026-44487 4 months ago

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usa…

7.5High

CVE-2026-44488 4 months ago

Axios: Allocation of Resources Without Limits or Throttling in axios

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or r…

7.5High

CVE-2026-44496 4 months ago

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard…

5.4%EPSS

7.0High

CVE-2026-44495 4 months ago

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Ob…

8.7High

CVE-2026-44494 4 months ago

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escal…

1.1%EPSS

8.6High

CVE-2026-44492 4 months ago

Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IP…

12%EPSS

8.8High

CVE-2026-45447 5 months ago

Heap Use-After-Free in the PKCS7_verify() Function

OpenSSL OpenSSL; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. Wh…

4.0%EPSS

6.5Medium

CVE-2026-27145 5 months ago

Inefficient candidate hostname parsing in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

9.6Critical

CVE-2026-39821 5 months ago

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS

10.0Critical

CVE-2026-46595 5 months ago

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.