Red Hat Multicluster Engine For Kubernetes
20 CVEs affecting Red Hat Multicluster Engine For Kubernetes. Latest disclosed: 2026-08-21. Critical: 6, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66795 | Critical | 9.9 | 2026-08-17 | A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifi… |
CVE-2026-73269 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigge… |
CVE-2026-73268 | Critical | 9.9 | 2026-08-12 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resourc… |
CVE-2026-16242 | Critical | 9.4 | 2026-07-20 | A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and… |
CVE-2026-66794 | Critical | 9.3 | 2026-08-19 | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can a… |
CVE-2026-10059 | Critical | 9.1 | 2026-08-05 | A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this… |
CVE-2026-75924 | High | 8.7 | 2026-08-18 | A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across… |
CVE-2026-17107 | High | 8.5 | 2026-07-24 | A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE)… |
CVE-2024-3727 | High | 8.3 | 2024-05-14 | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a vi… |
CVE-2026-4740 | High | 8.2 | 2026-04-07 | A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes clien… |
CVE-2025-2241 | High | 8.2 | 2025-03-17 | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be e… |
CVE-2026-73267 | High | 7.7 | 2026-08-21 | A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim r… |
CVE-2026-75569 | High | 7.7 | 2026-08-19 | A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as c… |
CVE-2026-73266 | High | 7.1 | 2026-08-13 | A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating… |
CVE-2026-10805 | Medium | 6.7 | 2026-06-04 | A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufac… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-7195 | Medium | 6.4 | 2025-08-07 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15… |
CVE-2026-10101 | Medium | 6.3 | 2026-05-29 | ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace… |
CVE-2026-19130 | Medium | 5.8 | 2026-08-12 | A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and kn… |
CVE-2024-12401 | Medium | 4.4 | 2024-12-12 | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resour… |