Red Hat Multicluster Engine for Kubernetes
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-114236 | | Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers | LOW 3.3 | 0.1 % | ||
| CVE-2026-71297 | | Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-71299 | | Maestro: maestro: rest api write endpoints registered without authentication middleware | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-71298 | | Maestro: sql identifier injection via properties.* search filter and orderby field | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-101919 | | Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane | HIGH 8.8 | 0.4 % | ||
| CVE-2026-75924 | | Managed-serviceaccount: managed-serviceaccount: hub addon-manager clusterrole grants cluster-wide secret read/write and csr approval | HIGH 8.7 | 0.3 % | ||
| CVE-2026-16242 | | Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates | CRITICAL 9.4 | 0.9 % | ||
| CVE-2026-10805 | | Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend | MEDIUM 6.7 | 0.2 % | ||
| CVE-2026-10101 | | Assisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users | MEDIUM 6.3 | 0.2 % | ||
| CVE-2025-57851 | | Mce: privilege escalation via excessive /etc/passwd permissions | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-4740 | | Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation | HIGH 8.2 | 0.1 % | ||
| CVE-2025-2241 | | Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm | HIGH 8.2 | 0.5 % | ||
| CVE-2024-12401 | | Cert-manager: potential dos when parsing specially crafted pem inputs | MEDIUM 4.4 | 0.7 % |