A CVSS 9.1 flaw in the managedcluster-import-controller lets a privileged service account on a spoke cluster forge a Certificate Signing Request and escalate to administrative credentials on the hub cluster.
What Is It
Red Hat disclosed a certificate validation weakness (CWE-295) in the managedcluster-import-controller, the component responsible for onboarding managed clusters in Red Hat's Multicluster Engine for Kubernetes.
The controller's CSR auto-approval logic does not properly validate incoming Certificate Signing Requests. Specifically, it fails to inspect the signer name and does not decode the PEM-encoded x509 CSR before approving it. An attacker who already controls a privileged service account on a spoke cluster can submit a crafted CSR that the controller blindly auto-approves, yielding administrative credentials on the hub.
CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base score 9.1, CRITICAL.
Why It Matters
The severity comes from the scope change (S:C). Compromise of a single spoke, the lower-trust edge of a multicluster deployment, pivots directly into full administrative control of the hub, inverting the entire trust model. The hub governs policy, placement, and credentials across every managed cluster it owns, so hub admin is effectively fleet-wide admin.
Attack complexity is low and no user interaction is required. The PR:H requirement is the only meaningful barrier: the attacker needs a privileged service account on a spoke first. In practice, that is a realistic second-stage objective after any workload compromise on a managed cluster.
Confidentiality, integrity, and availability impact are all rated HIGH.
What's Vulnerable
- Vendor: Red Hat
- Product: Multicluster Engine for Kubernetes
- Package:
multicluster-engine/managedcluster-import-controller-rhel9 - CPE:
cpe:/a:redhat:multicluster_engine - Default status: affected
Specific fixed version ranges are not enumerated in the supplied NVD record.
Patch Status
The CVE was published 2026-08-17 with a vulnerability status of Received: the NVD record is not yet fully analyzed. No CISA KEV entry accompanies this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline at this time.
No patch details, fixed versions, or mitigations are included in the supplied source data. Consult the Red Hat security advisory and Bugzilla tracker below for current errata status.
Sources
- Red Hat Security; CVE-2026-66795: https://access.redhat.com/security/cve/CVE-2026-66795
- Red Hat Bugzilla #2507540: https://bugzilla.redhat.com/show_bug.cgi?id=2507540
- NVD, CVE-2026-66795 (published 2026-08-17, source
[email protected])