What’s Vulnerable › Products

Red Hat multicluster engine for Kubernetes 2.17 vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your Red Hat multicluster engine for Kubernetes 2.17 version is affected

Latest Red Hat multicluster engine for Kubernetes 2.17 vulnerabilities

• CVE-2026-73267 — Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check (CVSS 7.7)
• CVE-2026-75569 — Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha (CVSS 7.7)
• CVE-2026-66794 — Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route (CVSS 9.3)
• CVE-2026-66795 — Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) (CVSS 9.9)
• CVE-2026-73266 — Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join (CVSS 7.1)
• CVE-2026-19130 — Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization (CVSS 5.8)
• CVE-2026-73269 — Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa (CVSS 9.9)
• CVE-2026-73268 — Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection (CVSS 9.9)
• CVE-2026-17107 — Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster (CVSS 8.5)
• CVE-2026-16242 — Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates (CVSS 9.4)