Description
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Published: 2026-08-19
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The cluster-proxy-addon component of Red Hat Multicluster Engine for Kubernetes contains a flaw that allows an unauthenticated attacker to bypass authentication and authorization checks. This flaw is classified as CWE-918 (Server Side Request Forgery). By manipulating URL path segments in requests sent to the public user-facing Route, the attacker can proxy traffic to arbitrary services exposed within any managed cluster. This can lead to information disclosure or further compromise of cluster resources.

Affected Systems

Affected installations are those running Red Hat Multicluster Engine for Kubernetes. No specific product versions have been disclosed.

Risk and Exploitability

The flaw is rated CVSS 9.3, indicating a high severity. No EPSS score is available and it is not listed in the CISA KEV catalog, so current exploit probability is unknown. The likely attack vector involves sending a crafted request to the exposed cluster-proxy-addon Route from an external network. If a successful SSRF is executed, the attacker gains unauthorized access to internal cluster services, potentially leading to data exposure and further lateral movement.

Generated by OpenCVE AI on August 20, 2026 at 13:17 UTC.

Remediation

Vendor Workaround

To mitigate this issue, restrict network access to the user-facing Route of the `cluster-proxy-addon` to trusted networks only. Implement firewall rules to limit inbound connections to the Route's exposed port, ensuring only authorized sources can reach it. This reduces the attack surface by preventing unauthenticated external access to the vulnerable proxy.

OpenCVE Recommended Actions

  • Restrict access to the cluster-proxy-addon Route by configuring firewall rules or network policies to allow traffic only from trusted IP ranges.
  • Disable the public route of the cluster-proxy-addon if it is not required for operational purposes.
  • Monitor network traffic and access logs for abnormal SSRF activity to detect exploitation attempts.
  • When a vendor patch or an updated release of Multicluster Engine for Kubernetes becomes available, upgrade the component to eliminate the vulnerability.

Generated by OpenCVE AI on August 20, 2026 at 13:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine cpe:/a:redhat:multicluster_engine:2.10::el9
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_engine:2.8::el9
cpe:/a:redhat:multicluster_engine:2.9::el9
References

Tue, 25 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.17::el9
References

Tue, 25 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:multicluster_engine:2.11::el9
References

Fri, 21 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat multicluster Engine For Kubernetes
Vendors & Products Redhat multicluster Engine For Kubernetes

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 19 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Title Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route
First Time appeared Redhat
Redhat multicluster Engine
Weaknesses CWE-918
CPEs cpe:/a:redhat:multicluster_engine
Vendors & Products Redhat
Redhat multicluster Engine
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Redhat Multicluster Engine Multicluster Engine For Kubernetes
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-09-08T12:15:02.672Z

Reserved: 2026-07-27T17:51:24.886Z

Link: CVE-2026-66794

cve-icon Vulnrichment

Updated: 2026-08-21T19:33:13.505Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-19T18:17:16.547

Modified: 2026-09-08T13:17:21.050

Link: CVE-2026-66794

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-19T14:00:00Z

Links: CVE-2026-66794 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T13:30:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)