Red Hat multicluster engine for Kubernetes 2.9.

Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• CWE-602

Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• CWE-1357

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Server-side request forgery (SSRF)

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Weak cryptography or TLS

Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• CWE-441

Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Broken access control

Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Code injection

Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• Privilege escalation

Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Privilege escalation

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

• Red Hat multicluster engine for Kubernetes 2.10
• Red Hat multicluster engine for Kubernetes 2.11
• CWE-441

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Authentication bypass

Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

• Red Hat multicluster engine for Kubernetes 2.1
• Red Hat multicluster engine for Kubernetes 2.11
• Information disclosure