Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-66794 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-08-19 |
| Vendor | Red Hat |
| Product | Advanced Cluster Management |
| CVSS Score | 9.3 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or furthe…
Required Actions
- Apply the Red Hat fixes for Multicluster Engine and Advanced Cluster Management per the advisories for CVE-2026-66794 and CVE-2026-71470.
- Assess the blast radius correctly: MCE manages many clusters at once. An authentication bypass in the proxy does not affect one environment, but everything the instance can reach.
- Check whether the
cluster-proxy-addonroute is exposed outside the internal network. The attack requires access to a user-facing route, so limiting exposure narrows the window considerably. - For CVE-2026-71470, review who holds Custom Resource editor rights for Search resources. This flaw effectively turns that permission into the ability to read arbitrary cluster secrets.
Who Is Affected?
Organizations using Red Hat Advanced Cluster Management or Multicluster Engine to manage OpenShift and Kubernetes environments. Typically banking, telecom and large container estates.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
