A path-manipulation flaw in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes lets an unauthenticated attacker bypass authentication and proxy requests to arbitrary services across any managed cluster, rated CVSS 3.1 9.3 (Critical).
What Is It
CVE-2026-66794 is a server-side request forgery issue (CWE-918) in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. Any attacker who can reach the user-facing route can manipulate URL path segments to defeat the component's authentication and authorization checks. Once past those checks, requests are proxied to arbitrary services on any managed cluster; services that were never meant to be exposed. Red Hat scores it CVSS 3.1 9.3 Critical with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N: network-reachable, low complexity, no privileges, no user interaction, and a changed scope with high confidentiality impact.
Why It Matters
The preconditions are minimal. No credentials, no user interaction, no unusual attack position; just network access to the user-facing route. The scope-changed rating indicates Red Hat assessed the impact as extending beyond the proxy component itself, which suggests the flaw could serve as a pivot toward the internal service surface of clusters the engine manages. Red Hat's description cites information disclosure and further compromise of the cluster environment as the likely outcomes. In a multicluster deployment, a single exposed route may therefore translate into reachability across a broader portion of the managed fleet, though the supplied data does not detail how far that reach extends in a given configuration.
What's Vulnerable
Red Hat lists Multicluster Engine for Kubernetes as affected, specifically the packages:
multicluster-engine/cluster-proxy-addon-rhel9multicluster-engine/cluster-proxy-rhel9
The default status for both is affected. CPE: cpe:/a:redhat:multicluster_engine.
Patch Status
The CVE was published 2026-08-19 with NVD status Received, the record has not yet been fully analyzed or enriched. The supplied data contains no fixed version, patch, or workaround details. Consult the Red Hat security advisory and Bugzilla entry below for current remediation guidance.
This CVE does not appear in the supplied CISA KEV data; there is no confirmed active exploitation and no KEV-mandated remediation deadline on record.
Sources
- Red Hat Security; CVE-2026-66794: https://access.redhat.com/security/cve/CVE-2026-66794
- Red Hat Bugzilla #2507539: https://bugzilla.redhat.com/show_bug.cgi?id=2507539
- NVD, CVE-2026-66794: https://nvd.nist.gov/vuln/detail/CVE-2026-66794