CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2026-66794

creationtimestamp| type| source ---|---|--- 2026-08-19 17:59:53+00:00| seen| https://bsky.app/profile/suriq.io/post/3mthcpsnyvb25 2026-08-19 19:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mthg536zyw22 2026-08-19 20:10:05+00:00| seen|...

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

CVE-2026-66794

A critical (CVSS 9.3) unauthenticated SSRF vulnerability exists in the cluster-proxy-addon component of Multicluster Engine for Kubernetes . An attacker with network access to the user-facing route can bypass authentication and authorization by manipulating URL path segments, proxying requests to...