VDB

CVE-2026-19130

CVE-2026-19130 PUBLISHED CVSS 5.8 MEDIUM

Reported by redhat · Published August 12, 2026

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

Risk Scores

CVSS 3.1
5.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787176886
Red Hatmulticluster engine for Kubernetes 2.111787239595
Red Hatmulticluster engine for Kubernetes 2.171786664288
Red Hatmulticluster engine for Kubernetes 2.61787260821
Red Hatmulticluster engine for Kubernetes 2.81787259099
Red Hatmulticluster engine for Kubernetes 2.91787176716
Red Hatmulticluster engine for Kubernetes 2.61787260821
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.101787176886
Red Hatmulticluster engine for Kubernetes 2.9.01787176716
Red Hatmulticluster engine for Kubernetes 2.171786664288, 1786664288, 1786664288
Red Hatmulticluster engine for Kubernetes 2.11787176886
Red Hatmulticluster engine for Kubernetes 2.111787239595
Red Hatmulticluster engine for Kubernetes 2.81787259099
Red Hatmulticluster engine for Kubernetes 2.91787176716

Timeline

  • Aug 12, 2026 CVE Published
  • Aug 13, 2026 Coalition ESS Score
  • Aug 14, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Sep 5, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 17, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›