Veille CVE

Recherche « Red Hat multicluster engine for Kubernetes 2.17 »

14 CVE

Critique 6 Élevée 6 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat multicluster engine for Kubernetes 2.17 » ✕
  1. CVE-2026-73267 7.7 Élevée

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to specify and delete any ManagedCluster, including the hub's local-cluster or other tenants' clusters, due to a missing ownership check. This vulnerability can lead to a denial of service by enabling unauthorized deletion of ManagedClusters.

  2. CVE-2026-75569 7.7 Élevée

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

  3. CVE-2026-66794 9.3 Critique

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

  4. CVE-2026-66795 9.9 Critique

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

  5. CVE-2026-73266 7.1 Élevée

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

  6. CVE-2026-19130 5.8 Moyenne

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

  7. CVE-2026-73269 9.9 Critique

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privileges from namespace-local access to cluster-wide control. This privilege escalation grants broad permissions, including the ability to access and manipulate secrets, manage cluster actions, and delete hosted clusters or node pools.

  8. CVE-2026-73268 9.9 Critique

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected Job to run with the controller's elevated privileges, leading to arbitrary code execution and privilege escalation, potentially accessing cluster-wide secrets.

  9. CVE-2026-17107 8.5 Élevée

    Red Hat multicluster engine for Kubernetes 2.10 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

  10. CVE-2026-16242 9.4 Critique

    Red Hat multicluster engine for Kubernetes 2.1 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17 · Red Hat multicluster engine for Kubernetes 2.6

    A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

  11. CVE-2026-13676 7.5 Élevée

    fast-uri · Red Hat AMQ Broker 7.13.6 · Red Hat AMQ Broker 7.14.1 · Red Hat Enterprise Linux 10

    fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

  12. CVE-2026-44990 9.3 Critique

    apostrophecms sanitize-html · Red Hat multicluster engine for Kubernetes 2.1 · Red Hat multicluster engine for Kubernetes 2.11 · Red Hat multicluster engine for Kubernetes 2.17

    ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can lead to stored XSS in applications that render sanitized output back to users. Version 2.17.4 patches the issue.

  13. CVE-2026-39835 5.3 Moyenne

    golang.org/x/crypto/ssh · Red Hat Cryostat 4 on RHEL 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8

    SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

  14. CVE-2026-39829 7.5 Élevée

    golang.org/x/crypto/ssh · Red Hat Cryostat 4 on RHEL 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8

    The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.