Advisories · Technology
Red Hat multicluster engine for Kubernetes 2.17.
Every CVE that names Red Hat multicluster engine for Kubernetes 2.17 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-602
- CVSS 7.7 High
Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-1357
- CVSS 9.3 CriticalCritical · CVSS 9+
Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- Weak cryptography or TLS
- CVSS 7.1 High
Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-441
- CVSS 5.8 Medium
Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- Code injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- Privilege escalation
- CVSS 8.5 High
Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-441
- CVSS 9.4 CriticalCritical · CVSS 9+
Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
- Red Hat multicluster engine for Kubernetes 2.1
- Red Hat multicluster engine for Kubernetes 2.11
- Authentication bypass