CVE-2026-10059 Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

EUVD-2026-53293

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059 Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059

The CVE-2026-10059 issue affects the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can create a namespaced ClusterCurator, which inadvertently enables minting a token for a ServiceAccount with cluster-wide administrative auth...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059: Incorrect Privilege Assignment

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.17.1 security update

Red Hat multicluster engine for Kubernetes v2.17 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.4 security update

Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.6 security update

Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.13 security update

Red Hat multicluster engine for Kubernetes v2.6 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.9 security update

Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update

Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update

The multicluster engine for Kubernetes 2.10 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.10 images The multicluster engine for Kubernetes provides the foundational components that a...

EUVD-2026-48728

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-17107: Unintended Proxy or Intermediary

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.12 security update

The multicluster engine for Kubernetes 2.6 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.6 images The multicluster engine for Kubernetes provides the foundational components that are...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.12 security update

The multicluster engine for Kubernetes 2.6 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.6 images The multicluster engine for Kubernetes provides the foundational components that are...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.10.4

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.10.4 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.10.4 release that simplify the process of...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.5 security update

The multicluster engine for Kubernetes 2.9 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.9 images The multicluster engine for Kubernetes provides the foundational components that are...