CVE-2026-66794

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:59556
https://access.redhat.com/errata/RHSA-2026:59557
https://access.redhat.com/errata/RHSA-2026:59558
https://access.redhat.com/errata/RHSA-2026:59559
https://access.redhat.com/errata/RHSA-2026:59579
https://access.redhat.com/errata/RHSA-2026:59593
https://access.redhat.com/security/cve/CVE-2026-66794
https://bugzilla.redhat.com/show_bug.cgi?id=2507539

Configurations

No configuration.

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en el componente ’cluster-proxy-addon’ de Multicluster Engine para Kubernetes. Esta vulnerabilidad permite a un atacante no autenticado, que puede acceder a la ruta orientada al usuario, eludir las comprobaciones de autenticación y autorización. Al manipular segmentos de la ruta URL, el atacante puede hacer proxy de solicitudes a servicios arbitrarios en cualquier clúster gestionado. Esto permite el acceso no autorizado a servicios internos que de otro modo estarían protegidos, lo que podría llevar a la revelación de información o a un compromiso adicional del entorno del clúster.

Information

Published : 2026-08-19 18:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-66794

Mitre link : CVE-2026-66794

CVE.ORG link : CVE-2026-66794

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-66794", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66794", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:33:05.335178Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "versions": [{"status": "unaffected", "version": "1787173361", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787276784", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1786983349", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "versions": [{"status": "unaffected", "version": "1787275318", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "versions": [{"status": "unaffected", "version": "1787275519", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "versions": [{"status": "unaffected", "version": "1787274923", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/cluster-proxy-addon-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-08-19T18:17:16.547", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-66794", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507539", "source": "secalert@redhat.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente \u2019cluster-proxy-addon\u2019 de Multicluster Engine para Kubernetes. Esta vulnerabilidad permite a un atacante no autenticado, que puede acceder a la ruta orientada al usuario, eludir las comprobaciones de autenticaci\u00f3n y autorizaci\u00f3n. Al manipular segmentos de la ruta URL, el atacante puede hacer proxy de solicitudes a servicios arbitrarios en cualquier cl\u00faster gestionado. Esto permite el acceso no autorizado a servicios internos que de otro modo estar\u00edan protegidos, lo que podr\u00eda llevar a la revelaci\u00f3n de informaci\u00f3n o a un compromiso adicional del entorno del cl\u00faster."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "secalert@redhat.com"}