Red Hat multicluster engine for Kubernetes 2.10 vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest Red Hat multicluster engine for Kubernetes 2.10 vulnerabilities

CVE-2026-73267 — Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check (CVSS 7.7)
CVE-2026-75569 — Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha (CVSS 7.7)
CVE-2026-66794 — Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route (CVSS 9.3)
CVE-2026-66795 — Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) (CVSS 9.9)
CVE-2026-73266 — Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join (CVSS 7.1)
CVE-2026-19130 — Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization (CVSS 5.8)
CVE-2026-73269 — Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa (CVSS 9.9)
CVE-2026-73268 — Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection (CVSS 9.9)
CVE-2026-17107 — Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster (CVSS 8.5)