VDB

CVE-2026-66795

CVE-2026-66795 PUBLISHED CVSS 9.9 CRITICAL

Reported by redhat · Published August 17, 2026

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

Risk Scores

CVSS 3.1
9.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.101787078272
Red Hatmulticluster engine for Kubernetes 2.111787078330
Red Hatmulticluster engine for Kubernetes 2.171786577915
Red Hatmulticluster engine for Kubernetes 2.61787260779
Red Hatmulticluster engine for Kubernetes 2.81787259044
Red Hatmulticluster engine for Kubernetes 2.91787078307
Red Hatmulticluster engine for Kubernetes 2.111787078330
Red Hatmulticluster engine for Kubernetes 2.61787260779
Red HatMulticluster Engine for Kubernetes
Red Hatmulticluster engine for Kubernetes 2.171786577915
Red Hatmulticluster engine for Kubernetes 2.9.01787078307
Red Hatmulticluster engine for Kubernetes 2.91787078307
Red Hatmulticluster engine for Kubernetes 2.81787259044
Red Hatmulticluster engine for Kubernetes 2.11787078272
Red Hatmulticluster engine for Kubernetes 2.101787078272

Timeline

  • Aug 17, 2026 CVE Published
  • Aug 18, 2026 EPSS Score
  • Aug 18, 2026 Coalition ESS Score
  • Aug 18, 2026 CVE Updated
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 2, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›