Vulnerabilities

TI-2026-14230 CVE-2026-17107 · GHSA-vr7g-637m-v9mm

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

MEDIUM 40

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE).

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00568 Published 2026-07-24 Fixed in 1784342329, 1784925025 +3 CWE-441

TI-2026-13581 CVE-2026-16242 · GHSA-43hh-68v6-mf36

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

MEDIUM 50

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00918 Published 2026-07-20 Fixed in 1784905766, 1784945966 +13 CWE-306

Vulnerabilities

Filters

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates