CVE-2026-66795: Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-17 · updated 2026-09-29
Weakness: CWE-295

Description

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

Affected products

Red Hat multicluster engine for Kubernetes 2.10: all versions — fixed in 1787078272
Red Hat multicluster engine for Kubernetes 2.11: all versions — fixed in 1787078330
Red Hat multicluster engine for Kubernetes 2.17: all versions — fixed in 1786577915
Red Hat multicluster engine for Kubernetes 2.6: all versions — fixed in 1787260779
Red Hat multicluster engine for Kubernetes 2.8: all versions — fixed in 1787259044
Red Hat multicluster engine for Kubernetes 2.9: all versions — fixed in 1787078307

How to fix

Upgrade to a fixed version: Red Hat multicluster engine for Kubernetes 2.10 1787078272; Red Hat multicluster engine for Kubernetes 2.11 1787078330; Red Hat multicluster engine for Kubernetes 2.17 1786577915; Red Hat multicluster engine for Kubernetes 2.6 1787260779; Red Hat multicluster engine for Kubernetes 2.8 1787259044; Red Hat multicluster engine for Kubernetes 2.9 1787078307. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-66795 or the next vulnerability affects your stack