Skip to main content

Kubernetes CVE-2026-17107

| EUVDEUVD-2026-48728 HIGH
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441)
2026-07-24 redhat
Kubernetes Red Hat Privilege Escalation Multicluster Engine For Kubernetes
8.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Red Hat
8.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 11:41 vuln.today
CVE Published
Jul 24, 2026 - 18:56 nvd
HIGH 8.5

DescriptionCVE.org

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

AnalysisAI

We need to produce a JSON with the specified fields. Let's analyze the input.

CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits.

EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R

More in Kubernetes

View all
CVE-2025-1974 CRITICAL POC
9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2025-1098 HIGH POC
8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
CVE-2025-1097 HIGH POC
8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
CVE-2020-8554 MEDIUM POC
6.3 Jan 21

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
CVE-2023-3676 HIGH POC
8.8 Oct 31

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
CVE-2025-55190 CRITICAL POC
9.9 Sep 04

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
CVE-2026-34976 CRITICAL POC
10.0 Apr 02

Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
CVE-2018-18843 CRITICAL POC
10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
CVE-2026-54680 CRITICAL POC
9.9 Jul 29

Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
CVE-2026-22039 CRITICAL POC
9.9 Jan 27

Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass

Same weakness CWE-441 – Unintended Proxy or Intermediary ('Confused Deputy')

View all
CVE-2026-72526 CRITICAL
9.9
CVE-2026-70398 CRITICAL
9.6
CVE-2026-42933 CRITICAL
10.0
CVE-2019-3924 HIGH POC
7.5
CVE-2020-5412 MEDIUM POC
6.5
CVE-2019-3996 MEDIUM POC
6.5
CVE-2025-62718 MEDIUM POC
6.3
CVE-2026-16158 CRITICAL
10.0

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

Share

CVE-2026-17107 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy