VDB

CVE-2026-66794

CVE-2026-66794 PUBLISHED CVSS 9.3 CRITICAL

Reported by redhat · Published August 19, 2026

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

Risk Scores

CVSS 3.1
9.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787173361
Red Hatmulticluster engine for Kubernetes 2.111787276784
Red Hatmulticluster engine for Kubernetes 2.171786983349
Red Hatmulticluster engine for Kubernetes 2.61787275318
Red Hatmulticluster engine for Kubernetes 2.81787275519
Red Hatmulticluster engine for Kubernetes 2.91787274923
Red Hatmulticluster engine for Kubernetes 2.101787173361
Red Hatmulticluster engine for Kubernetes 2.111787276784
Red Hatmulticluster engine for Kubernetes 2.11787173361
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.61787275318
Red Hatmulticluster engine for Kubernetes 2.171786983349
Red Hatmulticluster engine for Kubernetes 2.9.01787274923
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.91787274923
Red Hatmulticluster engine for Kubernetes 2.81787275519

Timeline

  • Aug 19, 2026 CVE Published
  • Aug 20, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›