CVE-2026-66794
Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
CVSS Score
9.3
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
| CWE | CWE-918 |
| Vendor | red hat |
| Product | multicluster engine for kubernetes |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat multicluster engine for kubernetes
Be the first to know when new critical vulnerabilities affecting red hat multicluster engine for kubernetes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
Red Hat / Multicluster Engine for Kubernetes
All versions affected Red Hat / Multicluster Engine for Kubernetes
All versions affected