# Red Hat multicluster engine for Kubernetes 2.6.

Every CVE that names Red Hat multicluster engine for Kubernetes 2.6 among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check](https://agentprime.io/advisories/CVE-2026-73267.md)
  `CVE-2026-73267` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 7.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-602
- [Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha](https://agentprime.io/advisories/CVE-2026-75569.md)
  `CVE-2026-75569` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-1357
- [Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route](https://agentprime.io/advisories/CVE-2026-66794.md)
  `CVE-2026-66794` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)](https://agentprime.io/advisories/CVE-2026-66795.md)
  `CVE-2026-66795` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Weak cryptography or TLS
- [Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join](https://agentprime.io/advisories/CVE-2026-73266.md)
  `CVE-2026-73266` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-441
- [Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization](https://agentprime.io/advisories/CVE-2026-19130.md)
  `CVE-2026-19130` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control
- [Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection](https://agentprime.io/advisories/CVE-2026-73268.md)
  `CVE-2026-73268` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Code injection
- [Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa](https://agentprime.io/advisories/CVE-2026-73269.md)
  `CVE-2026-73269` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Privilege escalation
- [Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token](https://agentprime.io/advisories/CVE-2026-10059.md)
  `CVE-2026-10059` · CVE record: Red Hat multicluster engine for Kubernetes 2.1 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Privilege escalation
- [Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster](https://agentprime.io/advisories/CVE-2026-17107.md)
  `CVE-2026-17107` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 8.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-441
- [Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates](https://agentprime.io/advisories/CVE-2026-16242.md)
  `CVE-2026-16242` · CVE record: Red Hat multicluster engine for Kubernetes 2.1 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=red-hat-multicluster-engine-for-kubernetes-2-6>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/red-hat-multicluster-engine-for-kubernetes-2-6/>. Everything for agents: <https://agentprime.io/llms.txt>.