9.3

CVE-2026-66794

Medienbericht

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.10
Default Statusaffected
Version 1787173361
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.11
Default Statusaffected
Version 1787276784
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.17
Default Statusaffected
Version 1786983349
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.6
Default Statusaffected
Version 1787275318
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.8
Default Statusaffected
Version 1787275519
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt multicluster engine for Kubernetes 2.9
Default Statusaffected
Version 1787274923
Version < *
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 9.3 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
24.08.2026 18:15
https://access.redhat.com/security/cve/CVE-2026-66794
https://bugzilla.redhat.com/show_bug.cgi?id=2507539
https://access.redhat.com/errata/RHSA-2026:59556
https://access.redhat.com/errata/RHSA-2026:59593
https://access.redhat.com/errata/RHSA-2026:59557
https://access.redhat.com/errata/RHSA-2026:59559
https://access.redhat.com/errata/RHSA-2026:59579
https://access.redhat.com/errata/RHSA-2026:59558