CVE-2026-66794
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Severity
CRITICAL
CVSS score
9.3
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-19 18:17:16.547000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-66794",
"sourceIdentifier": "[email protected]",
"published": "2026-08-19T18:17:16.547",
"lastModified": "2026-10-26T11:10:00.157",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment."
},
{
"lang": "es",
"value": "Se encontró una falla en el componente ’cluster-proxy-addon’ de Multicluster Engine para Kubernetes. Esta vulnerabilidad permite a un atacante no autenticado, que puede acceder a la ruta orientada al usuario, eludir las comprobaciones de autenticación y autorización. Al manipular segmentos de la ruta URL, el atacante puede hacer proxy de solicitudes a servicios arbitrarios en cualquier clúster gestionado. Esto permite el acceso no autorizado a servicios internos que de otro modo estarían protegidos, lo que podría llevar a la revelación de información o a un compromiso adicional del entorno del clúster."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.10",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-addon-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
],
"versions": [
{
"version": "1787173361",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"versions": [
{
"version": "1787276784",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.17",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.17::el9"
],
"versions": [
{
"version": "1786983349",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-addon-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
],
"versions": [
{
"version": "1787275318",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-addon-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"versions": [
{
"version": "1787275519",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-addon-rhel9",
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
],
"versions": [
{
"version": "1787274923",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 4.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-21T19:33:05.335178Z",
"id": "CVE-2026-66794",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:59556",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59557",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59558",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59559",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59579",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:59593",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-66794",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507539",
"source": "[email protected]"
}
]
}