Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Red Hat multicluster engine for Kubernetes 2.17

10 vulnérabilités publiées citent ce produit.

Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.

CVEVersions vulnérablesTitreSévéritéPubliéeEPSSExploitation
CVE-2026-73267corrigé en 1786577950Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership checkHIGH 7.70.6 %
CVE-2026-75569corrigé en 1787083639Mce-operator-bundle: all github actions pinned by mutable tag, not commit shaHIGH 7.70.6 %
CVE-2026-66794corrigé en 1786983349Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public routeCRITICAL 9.30.6 %
CVE-2026-66795corrigé en 1786577915Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)CRITICAL 9.90.5 %
CVE-2026-73266corrigé en 1786577950Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant mana…HIGH 7.10.4 %
CVE-2026-19130corrigé en 1786664288Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom…MEDIUM 5.80.4 %
CVE-2026-73268corrigé en 1786750700Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injectionCRITICAL 9.90.9 %
CVE-2026-73269corrigé en 1786750700Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secr…CRITICAL 9.90.6 %
CVE-2026-17107corrigé en 1784926298Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterHIGH 8.50.6 %
CVE-2026-16242corrigé en 1784856942Hypershift: konnectivity proxy-server accepts agent connections without validating client certificatesCRITICAL 9.40.9 %