Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

191 matches found

Cvelist
Cvelist•added 2026/08/21 2:43 a.m.•55 views

CVE-2026-73267 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

7.7CVSS0.00626EPSS
SaveExploits0References8
CVE
CVE•added 2026/08/21 2:43 a.m.•120 views

CVE-2026-73267

In Red Hat's multicluster engine, the clusterclaims-controller deletes ManagedClusters based solely on clusterclaim.spec.namespace without verifying ownership. Any tenant with standard ClusterClaim permissions can delete any cluster, including the hub's local-cluster, causing a HIGH-severity (7.7...

7.7CVSS5.7AI score0.00626EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE•added 2026/08/21 2:43 a.m.•12 views

CVE-2026-73267

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

7.7CVSS5.7AI score0.00626EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies•added 2026/08/21 12:00 a.m.•27 views

PT-2026-79290

Name of the Vulnerable Software and Affected Versions multicluster engine affected versions not specified Description A flaw in the clusterclaims-controller component allows a tenant with standard permissions to create and delete ClusterClaim resources to cause a denial of service. By manipulatin...

7.7CVSS5.7AI score0.00626EPSS
SaveExploits0References12
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/08/21 12:00 a.m.•4 views

CVE-2026-73267: Client-Side Enforcement of Server-Side Security

A flaw was found in the clusterclaims-controller component of multicluster engine MCE. A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the spec.namespace field. This allows the tenant to specify and delete any ManagedCluster, includi...

7.7CVSS5.7AI score0.00626EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux•added 2026/08/19 11:13 p.m.•105 views

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.5 security update

Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

9.6CVSS6.5AI score0.02044EPSS
SaveExploits7References45
NVD
NVD•added 2026/08/19 6:17 p.m.•27 views

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

9.3CVSS0.00621EPSS
SaveExploits0References8
EUVD
EUVD•added 2026/08/19 5:30 p.m.•26 views

EUVD-2026-62598

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

9.3CVSS5.6AI score0.00621EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/08/19 5:30 p.m.•12 views

CVE-2026-66794 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

9.3CVSS5.9AI score0.00621EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE•added 2026/08/19 5:30 p.m.•30 views

CVE-2026-66794

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

9.3CVSS5.8AI score0.00621EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies•added 2026/08/19 12:00 a.m.•65 views

PT-2026-78547

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes affected versions not specified Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization check...

9.3CVSS5.9AI score0.00621EPSS
SaveExploits0References12
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/08/19 12:00 a.m.•1 views

CVE-2026-66794: Server-Side Request Forgery (SSRF)

A flaw was found in the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy...

9.3CVSS5.9AI score0.00621EPSS
SaveExploits0References2
NVD
NVD•added 2026/08/13 5:17 p.m.•12 views

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS0.00352EPSS
SaveExploits0References8
Cvelist
Cvelist•added 2026/08/13 4:36 p.m.•57 views

CVE-2026-73266 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS0.00352EPSS
SaveExploits0References8
CVE
CVE•added 2026/08/13 4:36 p.m.•52 views

CVE-2026-73266

CVE-2026-73266 affects the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can manipulate ClusterClaim labels to force a cluster to join a ManagedClusterSet owned by another tenant, enabling cross-tenant access and the potential injection of policies and w...

7.1CVSS5.7AI score0.00352EPSS
SaveExploits0References8
EUVD
EUVD•added 2026/08/13 4:36 p.m.•19 views

EUVD-2026-58132

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS5.3AI score0.00352EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/08/13 4:36 p.m.•17 views

CVE-2026-73266 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS5.7AI score0.00352EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE•added 2026/08/13 4:36 p.m.•15 views

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS5.7AI score0.00352EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)•added 2026/08/13 12:00 a.m.•1 views

CVE-2026-73266: Unintended Proxy or Intermediary

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

7.1CVSS5.7AI score0.00352EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies•added 2026/08/13 12:00 a.m.•11 views

PT-2026-71706

Name of the Vulnerable Software and Affected Versions Multicluster Engine affected versions not specified Description A flaw in the clusterclaims-controller component allows an authenticated tenant to manipulate ClusterClaim labels. This manipulation enables a tenant to force a cluster to join a...

7.1CVSS5.6AI score0.00352EPSS
SaveExploits0References11
Rows per page
Query Builder