Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
Priority LOW 37CWE-1357Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00598 48th percentileScored 2026-11-07
Fix Fixed Red Hat: 6 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.10 | — | 1787263075 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.11 | — | 1787321579 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.17 | — | 1787083639 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.6 | — | 1787317415 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.8 | — | 1787318262 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.9 | — | 1787287150 | Patch available | CNA |
- multicluster engine for Kubernetes 2.10 VendorRed Hat Affected — Fixed in 1787263075 Patch available CNA
- multicluster engine for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1787321579 Patch available CNA
- multicluster engine for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1787083639 Patch available CNA
- multicluster engine for Kubernetes 2.6 VendorRed Hat Affected — Fixed in 1787317415 Patch available CNA
- multicluster engine for Kubernetes 2.8 VendorRed Hat Affected — Fixed in 1787318262 Patch available CNA
- multicluster engine for Kubernetes 2.9 VendorRed Hat Affected — Fixed in 1787287150 Patch available CNA
CPE names CNA · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:multicluster_engine:2.10::el9 | 2.10 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.11::el9 | 2.11 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.17::el9 | 2.17 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.6::el9 | 2.6 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.8::el9 | 2.8 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.9::el9 | 2.9 | — | Red Hat |
- cpe:/a:redhat:multicluster_engine:2.10::el9 Versions 2.10 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.11::el9 Versions 2.11 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.17::el9 Versions 2.17 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.6::el9 Versions 2.6 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.8::el9 Versions 2.8 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.9::el9 Versions 2.9 — ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2026:59643 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.6.14 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/mce-operator-bundle
- RHSA-2026:59642 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.8.10 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/mce-operator-bundle
- RHSA-2026:59638 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.9.7 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/mce-operator-bundle
Show 3 more Red Hat advisories
- RHSA-2026:59637 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.10.6 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/mce-operator-bundle
- RHSA-2026:59636 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.11.6 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/mce-operator-bundle
- RHSA-2026:59634 Released 2026-08-25 · Red Hat rating Importantmulticluster engine for Kubernetes v2.17.2 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/mce-operator-bundle
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| multicluster engine for Kubernetes 2.10 | Fixed | RHSA-2026:59637 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:59636 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:59634 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:59643 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:59642 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:59638 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-75569
- 2026-10-03 Alias added: GHSA-77qj-pc4h-hxwh
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-75569 · CVE Program
- CVE-2026-75569 · NVD
- FIRST EPSS
- GHSA-77qj-pc4h-hxwh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-75569 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences