EUVD-2026-60452
GHSA-w9c6-w29v-4vp6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PR:H because a privileged spoke service account is required; AV:N/AC:L for straightforward API-based submission; S:C and C/I/A:H because a spoke foothold yields full admin control of the separate hub cluster.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
AnalysisAI
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a privileged service account on a managed spoke cluster to forge a Certificate Signing Request that the hub's auto-approval logic accepts without validating the signer name or decoding the PEM x509 body, yielding administrative credentials on the central hub cluster. Any environment running the affected controller across a hub-and-spoke fleet is exposed, and the scope-changing nature (spoke-to-hub) makes this a fleet-wide compromise vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already control a privileged service account on a spoke (managed) cluster that has permission to submit CSRs, and that the hub is running the managedcluster-import-controller with its CSR auto-approval logic enabled - the exact code path that fails to inspect the signer name or decode the PEM x509 CSR. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) is internally consistent with the description: network-reachable Kubernetes API, low complexity, but PR:H because the attacker must already control a privileged service account on a spoke cluster, and S:C because a spoke foothold escalates to the separate hub cluster. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised, or legitimately operates, a privileged service account on a managed spoke cluster crafts a malicious CSR whose x509 subject requests a privileged identity (e.g. a system:masters group binding) on the hub. … |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66795 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2507540 for the fixed Multicluster Engine build and upgrade to it once published; no exact fix version is provided in the input data, so the released patched version is not independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all hubs and managed spoke clusters in your environment running the managedcluster-import-controller, and document the service account permissions and cluster-to-cluster network access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user ga
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code e
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated t
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials t
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today