CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

PT-2026-78547

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes affected versions not specified Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization check...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266 Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

CVE-2026-73266 affects the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can manipulate ClusterClaim labels to force a cluster to join a ManagedClusterSet owned by another tenant, enabling cross-tenant access and the potential injection of policies and w...

CVE-2026-73266 Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

EUVD-2026-58132

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

PT-2026-71706

Name of the Vulnerable Software and Affected Versions Multicluster Engine affected versions not specified Description A flaw in the clusterclaims-controller component allows an authenticated tenant to manipulate ClusterClaim labels. This manipulation enables a tenant to force a cluster to join a...

CVE-2026-19130

A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...

EUVD-2026-57616

A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...

CVE-2026-19130 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...

CVE-2026-19130

The CVE-2026-19130 affects the provider-credential-controller component of multicluster-engine (MCE). The root cause is an authorization bypass that can be triggered by an attacker with specific hub-cluster permissions who knows a prior credential value, by manipulating copiedFrom labels. This co...

CVE-2026-19130 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...

CVE-2026-19130

A flaw was found in the provider-credential-controller component of multicluster-engine MCE. An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker...

CVE-2026-73268

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-73268

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-73268 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-73268

A flaw was found in the cluster-curator-controller component of multicluster engine MCE. A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob function does not validate user-controlled input when...

CVE-2026-73268

The CVE-2026-73268 entry concerns the cluster-curator-controller component of multicluster engine (MCE). A tenant with create/update permissions on ClusterCurator resources can inject an arbitrary Job specification via spec.install.overrideJob, because CreateJob() does not validate user-controlle...