EUVD-2026-57616
GHSA-3vwx-g7ch-f3wg
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Network-reachable but AC:H due to required prior credential knowledge; PR:L for specific hub RBAC foothold; UI:R for admin-triggered rotation; S:C reflects cross-cluster credential scope; no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.
AnalysisAI
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials through an authorization bypass in the provider-credential-controller component. An attacker with specific hub cluster permissions and prior knowledge of a credential value can manipulate copiedFrom labels to hijack the credential rotation process, gaining unauthorized read access to sensitive credentials scoped across managed clusters. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds specific low-privilege permissions on the MCE hub cluster sufficient to create or modify labels on credential-related objects, confirmed by PR:L in the CVSS vector - this is not default anonymous or guest access but a defined RBAC role on the hub; (2) the attacker possesses prior knowledge of an existing credential value, implying either a prior breach, insider access, or an earlier credential disclosure event - this is the knowledge prerequisite driving AC:H; (3) a hub cluster administrator triggers a provider credential rotation, satisfying the UI:R requirement and creating the window during which the intercepted credential can be captured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 5.8 (Medium) accurately reflects a chain of compounding prerequisites: high attack complexity (AC:H, requiring foreknowledge of a prior credential value), a low but non-zero privilege foothold on the hub cluster (PR:L), and a required user interaction (UI:R, likely the credential rotation event initiated by an administrator). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained low-privilege access to the hub cluster and possesses knowledge of an existing provider credential value crafts or modifies a `copiedFrom` label on a credential object, poisoning the provider-credential-controller's provenance logic. When a legitimate administrator subsequently initiates a provider credential rotation - satisfying the UI:R prerequisite - the manipulated label causes the controller to expose the newly rotated credential in a location or context the attacker can read, effectively intercepting the fresh secret before it propagates securely. … |
| Remediation | Consult the Red Hat Security advisory at https://access.redhat.com/security/cve/CVE-2026-19130 and Bugzilla report https://bugzilla.redhat.com/show_bug.cgi?id=2512105 for vendor-released patch details; no specific fixed version number was confirmed in available intelligence, so patch availability and target upgrade version must be verified directly with Red Hat. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user ga
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code e
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated t
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today