CVE-2026-66801

A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent a specification for describing event data in a common way message to the shared gh-spec topic. This message can spoof its source as...

Critical: Red Hat Security Advisory: Multicluster Global Hub 1.8.1 security update

Multicluster Global Hub v1.8.1 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

PT-2026-69873

Name of the Vulnerable Software and Affected Versions multicluster-global-hub affected versions not specified Description A flaw occurs during a ManagedClusterMigration where the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10090

The CVE concerns Red Hat ACM’s multicluster-operators-subscription: a namespace-scoped edit user in the ACM hub can create a Channel to a Helm repo they control and a Subscription referencing it. The app-subscription controller then fetches and applies the Helm chart with its own elevated authori...

CVE-2026-10059 Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

EUVD-2026-53293

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059 Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

CVE-2026-10059

The CVE-2026-10059 issue affects the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can create a namespaced ClusterCurator, which inadvertently enables minting a token for a ServiceAccount with cluster-wide administrative auth...

CVE-2026-10059

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.17.1 security update

Red Hat multicluster engine for Kubernetes v2.17 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.4 security update

Red Hat multicluster engine for Kubernetes v2.11 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.6 security update

Red Hat multicluster engine for Kubernetes v2.9 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.6.13 security update

Red Hat multicluster engine for Kubernetes v2.6 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.9 security update

Red Hat multicluster engine for Kubernetes v2.8 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update

Red Hat multicluster engine for Kubernetes v2.10 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base scor...

Important: Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update

Multicluster Global Hub v1.7.2 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Critical: Red Hat Security Advisory: multicluster engine for Kubernetes v2.10.4 security update

The multicluster engine for Kubernetes 2.10 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.10 images The multicluster engine for Kubernetes provides the foundational components that a...

EUVD-2026-48728

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...