EUVD-2026-63086
GHSA-77qj-pc4h-hxwh
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
PR:H reflects mandatory write access to the remote repo; AC:H reflects the build-trigger timing dependency; S:C captures downstream artifact distribution impact; A:N as availability is not directly affected.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
AnalysisAI
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code execution during the software build process. The build pipeline fetches and executes scripts from a remote repository without commit pinning or cryptographic signature verification, meaning any actor with write access to that upstream repository can inject malicious payloads that execute at build time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker hold write access to the specific remote repository from which the mce-operator-bundle build process fetches scripts - this is the critical prerequisite captured in CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score reflects a genuine but access-constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained write access to the remote repository referenced by the mce-operator-bundle build system - through credential theft, insider access, or a compromised maintainer account - pushes a modified script containing a backdoor payload. The next time the mce-operator-bundle build pipeline executes and fetches the script without integrity verification, the malicious payload runs with build-environment privileges, potentially embedding a trojan into the resulting operator bundle that is then distributed to all downstream Kubernetes clusters deploying the affected operator. … |
| Remediation | No specific patched release version has been confirmed in the available input data; the affected CPE covers all versions with a wildcard, and no fixed-version advisory has been published yet. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and deployments currently running mce-operator-bundle and document version numbers and build dates to establish your exposure baseline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privi
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user ga
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubern
Privilege escalation in Red Hat's managedcluster-import-controller (part of Multicluster Engine for Kubernetes) allows a
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A fla
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim p
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated t
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to esc
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials t
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShi
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today