5.8

CVE-2026-19130

Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.10
Default Statusaffected
Version 1787176886
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.11
Default Statusaffected
Version 1787239595
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.17
Default Statusaffected
Version 1786664288
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.6
Default Statusaffected
Version 1787260821
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.8
Default Statusaffected
Version 1787259099
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.9
Default Statusaffected
Version 1787176716
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.077
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 5.8 1.3 4
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://access.redhat.com/security/cve/CVE-2026-19130
https://bugzilla.redhat.com/show_bug.cgi?id=2512105
https://access.redhat.com/errata/RHSA-2026:59556
https://access.redhat.com/errata/RHSA-2026:59593
https://access.redhat.com/errata/RHSA-2026:59557
https://access.redhat.com/errata/RHSA-2026:59559
https://access.redhat.com/errata/RHSA-2026:59579
https://access.redhat.com/errata/RHSA-2026:59558