CVE-2026-17107

HIGH 8.5

Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster

CVSS Score

8.5

EPSS Score

0.3%

EPSS Percentile

28th

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

CWE	CWE-441
Vendor	red hat
Product	multicluster engine for kubernetes 2.10
Published	Jul 24, 2026
Last Updated	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for red hat multicluster engine for kubernetes 2.10

Be the first to know when new high vulnerabilities affecting red hat multicluster engine for kubernetes 2.10 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Red Hat / multicluster engine for Kubernetes 2.10

All versions affected

Red Hat / multicluster engine for Kubernetes 2.10

All versions affected

Red Hat / multicluster engine for Kubernetes 2.11

All versions affected

Red Hat / multicluster engine for Kubernetes 2.17

All versions affected

Red Hat / multicluster engine for Kubernetes 2.6

All versions affected

Red Hat / multicluster engine for Kubernetes 2.8

All versions affected

Red Hat / multicluster engine for Kubernetes 2.9

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/errata/RHSA-2026:46885 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47388 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47735 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47949 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47953 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:47974 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:48284 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-17107 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2506771

Credits

Red Hat would like to thank Arpit Jain (GitHub: arpitjain099) and Kahiro Okina (Craftsman Software, Inc.) for reporting this issue.