Red Hat Multicluster Engine For Kubernetes
14 CVEs affecting Red Hat Multicluster Engine For Kubernetes. Latest disclosed: 2026-11-09. Critical: 0, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-101919 | High | 8.8 | 2026-10-05 | A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged contr… |
CVE-2026-75924 | High | 8.7 | 2026-08-18 | A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across… |
CVE-2026-19706 | High | 8.3 | 2026-11-09 | During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network ca… |
CVE-2026-4740 | High | 8.2 | 2026-04-07 | A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes clien… |
CVE-2025-2241 | High | 8.2 | 2025-03-17 | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be e… |
CVE-2026-10805 | Medium | 6.7 | 2026-06-04 | A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufac… |
CVE-2026-71299 | Medium | 6.5 | 2026-10-05 | A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform un… |
CVE-2026-71298 | Medium | 6.4 | 2026-10-05 | A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. Thi… |
CVE-2025-57851 | Medium | 6.4 | 2026-04-08 | A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created… |
CVE-2025-7195 | Medium | 6.4 | 2025-08-07 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15… |
CVE-2026-10101 | Medium | 6.3 | 2026-05-29 | ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace… |
CVE-2026-71297 | Medium | 5.4 | 2026-10-05 | A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypas… |
CVE-2024-12401 | Medium | 4.4 | 2024-12-12 | A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resour… |
CVE-2026-114236 | Low | 3.3 | 2026-10-21 | storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls ca… |