EUVD-2026-62598
GHSA-9855-9cch-x8mw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated remote SSRF via crafted path (AV:N/AC:L/PR:N/UI:N); scope changes as the hub proxy reaches managed clusters (S:C) with high read exposure (C:H), limited integrity (I:L), no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Articles & Coverage 1
AnalysisAI
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the MCE hub's user-facing cluster-proxy-addon route and the ability to craft URL path segments that select a target service and managed cluster; per the CVSS vector (PR:N/UI:N) it is unauthenticated and needs no user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine high-priority issue rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 9.3) describes remote, low-complexity, unauthenticated exploitation with a scope change reflecting cross-cluster reach, which is exactly what the SSRF/auth-bypass description supports - the metrics and the narrative are consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the internet-exposed MCE hub proxy route sends an HTTP request with crafted URL path segments that name an internal service on a managed cluster. The proxy bypasses authorization and forwards the request, returning data from an internal API or service (for example a cluster's internal metadata or admin endpoint) to the unauthenticated attacker. … |
| Remediation | Apply the fixed cluster-proxy-addon/MCE release identified in the Red Hat erratum once available and monitor https://access.redhat.com/security/cve/CVE-2026-66794 for the exact patched version, as no specific fix version is provided in the available data (patch status per vendor advisory; released patched version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Red Hat MCE deployments and restrict external access to cluster-proxy-addon routes via firewall or network controls. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today