Improper certificate validation in Red Hat multicluster engine for Kubernetes 2.10
Priority MEDIUM 43CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295.
Summary
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.10 | — | 1787078272 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.11 | — | 1787078330 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.17 | — | 1786577915 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.6 | — | 1787260779 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.8 | — | 1787259044 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.9 | — | 1787078307 | Patch available | CNA |
- multicluster engine for Kubernetes 2.10 VendorRed Hat Affected — Fixed in 1787078272 Patch available CNA
- multicluster engine for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1787078330 Patch available CNA
- multicluster engine for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1786577915 Patch available CNA
- multicluster engine for Kubernetes 2.6 VendorRed Hat Affected — Fixed in 1787260779 Patch available CNA
- multicluster engine for Kubernetes 2.8 VendorRed Hat Affected — Fixed in 1787259044 Patch available CNA
- multicluster engine for Kubernetes 2.9 VendorRed Hat Affected — Fixed in 1787078307 Patch available CNA
CPE names CNA · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:multicluster_engine:2.10::el9 | 2.10 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.11::el9 | 2.11 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.17::el9 | 2.17 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.6::el9 | 2.6 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.8::el9 | 2.8 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.9::el9 | 2.9 | — | Red Hat |
- cpe:/a:redhat:multicluster_engine:2.10::el9 Versions 2.10 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.11::el9 Versions 2.11 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.17::el9 Versions 2.17 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.6::el9 Versions 2.6 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.8::el9 Versions 2.8 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.9::el9 Versions 2.9 — ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.2 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
- RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.14 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
- RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.7 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
Show 3 more Red Hat advisories
- RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.10 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
- RHSA-2026:59557 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.10.6 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +16
- RHSA-2026:59556 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.6 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +14
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:59557 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:59556 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:59593 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:59579 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:59558 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:59559 |
Not affected: 6 products
- multicluster engine for Kubernetes 2.10
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-66795
- 2026-10-03 Alias added: GHSA-w9c6-w29v-4vp6
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-66795 · CVE Program
- CVE-2026-66795 · NVD
- FIRST EPSS
- GHSA-w9c6-w29v-4vp6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-66795 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences