Red Hat Security Advisory

RHSA-2026:47953

multicluster engine for Kubernetes v2.9.6 security update

Released 2026-07-29 · Red Hat rating Critical · View on Red Hat →

Fixed in

multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/hypershift-rhel9-operator

Fixes 2 records

TI-2026-13581 CVE-2026-16242 · GHSA-43hh-68v6-mf36

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

MEDIUM 50

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00918 Published 2026-07-20 Fixed in 1784905766, 1784945966 +13 CWE-306

TI-2026-14230 CVE-2026-17107 · GHSA-vr7g-637m-v9mm

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

MEDIUM 40

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE).

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00568 Published 2026-07-24 Fixed in 1784342329, 1784925025 +3 CWE-441