Multicluster Engine For Kubernetes
Monthly
Arbitrary code execution in the control plane of Red Hat Multicluster Engine for Kubernetes (HyperShift operator) is possible when an authenticated user with cluster and secret creation permissions supplies a kubeconfig secret containing unauthorized executable credential plugins, which the operator copies without validation into the privileged control plane namespace. Downstream controllers that consume this configuration execute the plugins, granting full control plane compromise. The vulnerability requires low privileges (PR:L) and no user interaction, and no public exploit or CISA KEV entry is identified at time of analysis.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code execution during the software build process. The build pipeline fetches and executes scripts from a remote repository without commit pinning or cryptographic signature verification, meaning any actor with write access to that upstream repository can inject malicious payloads that execute at build time. The consequence extends beyond the build system itself (CVSS S:C) to the distributed artifacts, potentially delivering compromised software to all downstream consumers of the operator bundle. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation.
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated tenant to force a managed cluster into another tenant's ManagedClusterSet by manipulating ClusterClaim labels. The clusterclaims-controller processes these label changes without enforcing tenant ownership boundaries, enabling the attacker to then inject policies and workloads into clusters they do not own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature (S:C) and high confidentiality impact make this a serious multi-tenancy isolation failure.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. There is no public exploit identified at time of analysis, but the CVSS 9.9 rating reflects that a low-privileged tenant can obtain secrets access, manage cluster actions, and destroy hosted clusters or node pools.
Header injection in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to escalate to cluster-admin across all managed spoke clusters. The service-proxy forwards Kubernetes impersonation group headers to spoke clusters without stripping caller-supplied values first; because the spoke ServiceAccount holds unrestricted impersonation rights, an injected Impersonate-Group header (e.g., system:masters) is honored by every downstream cluster API server. No public exploit has been identified at time of analysis, and EPSS sits at 0.23%, though SSVC rates technical impact as total given the blast radius across the entire managed fleet.
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Authentication bypass in the maestro gRPC broker shipped with Red Hat Multicluster Engine for Kubernetes lets a client that already holds a valid mTLS client certificate skip the broker's authentication check and then subscribe to other consumers' event streams or publish forged agent status messages. The consequence is unauthorized information disclosure and loss of data integrity inside the broker, with no availability impact and scope unchanged; the assessed CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the valid-client-certificate prerequisite confines abuse to trusted-but-lower-privileged or already-compromised clients rather than anonymous remote attackers.
Unauthenticated REST API write access in Maestro, the messaging and resourcing component shipped with Red Hat Multicluster Engine for Kubernetes, lets a remote attacker create, modify, or delete consumers and resource bundles without supplying any credentials, token, or session. Because the affected endpoints were registered without authentication middleware (CWE-306), preconditions reduce to network reachability of the Maestro API: deployments where the API is cluster-internal, gated by NetworkPolicy, or fronted by an authenticating gateway/service mesh are materially less exposed, while anything publishing those endpoints are directly exploitable with no user interaction. The exploitability posture is driven by impact rather than by observed activity - integrity is assessed as high and availability as low, and no public exploit code or confirmed in-the-wild exploitation (CISA KEV) was identified at time of analysis.
SQL injection in the maestro component of Red Hat Multicluster Engine for Kubernetes (MCE) allows remote attackers to perform read-only blind extraction of database contents through the orderBy parameter on REST API list endpoints. The vendor CVSS vector specifies PR:L, indicating a low-privileged authenticated account may be needed, while the description and independent assessment note that authentication may not be required; defenders should resolve this discrepancy because it changes exposure materially. At time of analysis there is no public exploit identified, and exploitation is constrained by blind, read-only extraction and the requirement for network reachability to the vulnerable MCE API; CVSS is 6.4 medium severity.
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials through an authorization bypass in the provider-credential-controller component. An attacker with specific hub cluster permissions and prior knowledge of a credential value can manipulate `copiedFrom` labels to hijack the credential rotation process, gaining unauthorized read access to sensitive credentials scoped across managed clusters. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality impact and cross-cluster scope change make this a meaningful risk in mixed-trust MCE deployments.
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary OS commands with elevated privileges by supplying a crafted Manufacturer Usage Description (MUD) URL. Exploitation is strictly limited to systems where an administrator has explicitly reconfigured NetworkManager to use the dhclient backend - a non-default setting - meaning the vast majority of deployments are unaffected by design. CVSS 6.7 (local vector, high complexity, user interaction required) accurately reflects the constrained exploitation conditions; no public exploit code or CISA KEV listing exists at time of analysis.
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShift clusters provisioned through the MCE hub via the assisted-service REST API. The vulnerability exists in AUTH_TYPE=local mode (the only mode available in on-premises deployments), where the local authenticator grants full administrative access to any request bearing a valid JWT with no per-endpoint restrictions. A valid JWT is embedded as plaintext in the InfraEnvStatus.ISODownloadURL, readable by any user with get rights on an InfraEnv object, enabling extraction of kubeadmin passwords and kubeconfigs for all spoke clusters.
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to escalate from non-root container execution to full root privileges by exploiting group-writable permissions on the /etc/passwd file created during container image build time, enabling arbitrary UID assignment including UID 0.
Arbitrary code execution in the control plane of Red Hat Multicluster Engine for Kubernetes (HyperShift operator) is possible when an authenticated user with cluster and secret creation permissions supplies a kubeconfig secret containing unauthorized executable credential plugins, which the operator copies without validation into the privileged control plane namespace. Downstream controllers that consume this configuration execute the plugins, granting full control plane compromise. The vulnerability requires low privileges (PR:L) and no user interaction, and no public exploit or CISA KEV entry is identified at time of analysis.
Unauthorized ManagedCluster deletion in Red Hat Multicluster Engine (MCE) allows any tenant with standard ClusterClaim permissions to destroy clusters belonging to other tenants or the hub itself, including the hub's local-cluster. The clusterclaims-controller fails to verify ownership before acting on the spec.namespace field, meaning a low-privileged tenant can target arbitrary ManagedClusters by crafting that field and then deleting the ClusterClaim. No public exploit or CISA KEV listing exists at time of analysis, but the attack requires only standard tenant credentials and no special configuration, making it a realistic insider or compromised-tenant threat.
Supply chain code injection in Red Hat Multicluster Engine for Kubernetes (mce-operator-bundle) enables arbitrary code execution during the software build process. The build pipeline fetches and executes scripts from a remote repository without commit pinning or cryptographic signature verification, meaning any actor with write access to that upstream repository can inject malicious payloads that execute at build time. The consequence extends beyond the build system itself (CVSS S:C) to the distributed artifacts, potentially delivering compromised software to all downstream consumers of the operator bundle. No public exploit code exists and no CISA KEV listing is present at time of analysis.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
Privilege escalation in Red Hat Multicluster Engine for Kubernetes (MCE) lets a privileged service account on a managed spoke cluster submit a forged Certificate Signing Request that the managedcluster-import-controller auto-approves, yielding administrative credentials on the central hub cluster. The controller's auto-approval path neither inspects the CSR signer name nor decodes the PEM-encoded x509 request, so an attacker who already controls a spoke can pivot to full control of the hub and, by extension, every cluster it manages. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and CISA SSVC records no observed exploitation.
Unauthorized cross-tenant cluster takeover in Red Hat Multicluster Engine (MCE) for Kubernetes allows an authenticated tenant to force a managed cluster into another tenant's ManagedClusterSet by manipulating ClusterClaim labels. The clusterclaims-controller processes these label changes without enforcing tenant ownership boundaries, enabling the attacker to then inject policies and workloads into clusters they do not own. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changing nature (S:C) and high confidentiality impact make this a serious multi-tenancy isolation failure.
Privilege escalation and arbitrary code execution in Red Hat's multicluster engine (MCE) for Kubernetes lets a low-privileged tenant holding create or update rights on ClusterCurator resources hijack the cluster-curator-controller's service account. Because the CreateJob() function unmarshals the attacker-supplied spec.install.overrideJob raw extension without validation, the injected Job runs with the controller's elevated permissions, enabling cluster-wide secret access and full compromise. Rated CVSS 9.9 by Red Hat; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in Red Hat's multicluster engine for Kubernetes (MCE) lets a namespace-scoped authenticated user gain cluster-wide control by abusing the cluster-curator-controller. By creating a ClusterCurator custom resource with a specific, attacker-chosen naming convention, the user tricks the controller into minting a cluster-scoped ClusterRoleBinding on their behalf, breaking the namespace isolation boundary. There is no public exploit identified at time of analysis, but the CVSS 9.9 rating reflects that a low-privileged tenant can obtain secrets access, manage cluster actions, and destroy hosted clusters or node pools.
Header injection in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE) allows an authenticated hub principal to escalate to cluster-admin across all managed spoke clusters. The service-proxy forwards Kubernetes impersonation group headers to spoke clusters without stripping caller-supplied values first; because the spoke ServiceAccount holds unrestricted impersonation rights, an injected Impersonate-Group header (e.g., system:masters) is honored by every downstream cluster API server. No public exploit has been identified at time of analysis, and EPSS sits at 0.23%, though SSVC rates technical impact as total given the blast radius across the entire managed fleet.
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
A file descriptor leak in the containers/storage Go library's archive.ApplyLayer and ApplyUncompressedLayer functions causes descriptors to be left open whenever corrupt or malicious image layers or tar streams are unpacked, and repeated processing of such inputs can exhaust the hosting process's file descriptor limit. The weakness is unauthenticated in CVSS terms (PR:N) but local in scope (AV:L) and requires the victim to actually process attacker-influenced layers (UI:R), so an attacker must first get malformed image content in front of a build, pull, or sync loop. Impact is availability-only and confined to the affected process (C:N/I:N/A:L, S:U): no code execution and no data exposure; a single bad input does not cause denial of service, only sustained repetition does. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS scoring was not supplied with the source data.
Authentication bypass in the maestro gRPC broker shipped with Red Hat Multicluster Engine for Kubernetes lets a client that already holds a valid mTLS client certificate skip the broker's authentication check and then subscribe to other consumers' event streams or publish forged agent status messages. The consequence is unauthorized information disclosure and loss of data integrity inside the broker, with no availability impact and scope unchanged; the assessed CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, and the valid-client-certificate prerequisite confines abuse to trusted-but-lower-privileged or already-compromised clients rather than anonymous remote attackers.
Unauthenticated REST API write access in Maestro, the messaging and resourcing component shipped with Red Hat Multicluster Engine for Kubernetes, lets a remote attacker create, modify, or delete consumers and resource bundles without supplying any credentials, token, or session. Because the affected endpoints were registered without authentication middleware (CWE-306), preconditions reduce to network reachability of the Maestro API: deployments where the API is cluster-internal, gated by NetworkPolicy, or fronted by an authenticating gateway/service mesh are materially less exposed, while anything publishing those endpoints are directly exploitable with no user interaction. The exploitability posture is driven by impact rather than by observed activity - integrity is assessed as high and availability as low, and no public exploit code or confirmed in-the-wild exploitation (CISA KEV) was identified at time of analysis.
SQL injection in the maestro component of Red Hat Multicluster Engine for Kubernetes (MCE) allows remote attackers to perform read-only blind extraction of database contents through the orderBy parameter on REST API list endpoints. The vendor CVSS vector specifies PR:L, indicating a low-privileged authenticated account may be needed, while the description and independent assessment note that authentication may not be required; defenders should resolve this discrepancy because it changes exposure materially. At time of analysis there is no public exploit identified, and exploitation is constrained by blind, read-only extraction and the requirement for network reachability to the vulnerable MCE API; CVSS is 6.4 medium severity.
Credential interception in Red Hat Multicluster Engine for Kubernetes (MCE) exposes newly rotated provider credentials through an authorization bypass in the provider-credential-controller component. An attacker with specific hub cluster permissions and prior knowledge of a credential value can manipulate `copiedFrom` labels to hijack the credential rotation process, gaining unauthorized read access to sensitive credentials scoped across managed clusters. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the high confidentiality impact and cross-cluster scope change make this a meaningful risk in mixed-trust MCE deployments.
Local privilege escalation in NetworkManager's dhclient backend allows a low-privileged local user to execute arbitrary OS commands with elevated privileges by supplying a crafted Manufacturer Usage Description (MUD) URL. Exploitation is strictly limited to systems where an administrator has explicitly reconfigured NetworkManager to use the dhclient backend - a non-default setting - meaning the vast majority of deployments are unaffected by design. CVSS 6.7 (local vector, high complexity, user interaction required) accurately reflects the constrained exploitation conditions; no public exploit code or CISA KEV listing exists at time of analysis.
Authenticated users with minimal namespace-scoped privileges can obtain administrative credentials for arbitrary OpenShift clusters provisioned through the MCE hub via the assisted-service REST API. The vulnerability exists in AUTH_TYPE=local mode (the only mode available in on-premises deployments), where the local authenticator grants full administrative access to any request bearing a valid JWT with no per-endpoint restrictions. A valid JWT is embedded as plaintext in the InfraEnvStatus.ISODownloadURL, readable by any user with get rights on an InfraEnv object, enabling extraction of kubeadmin passwords and kubeconfigs for all spoke clusters.
Container privilege escalation in Red Hat Multicluster Engine for Kubernetes allows authenticated local attackers to escalate from non-root container execution to full root privileges by exploiting group-writable permissions on the /etc/passwd file created during container image build time, enabling arbitrary UID assignment including UID 0.