Skip to content
Fencer Vulns
critical 9.3

CVE-2026-66794 json

Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route

published 2026-08-19 2 mo ago modified 2026-10-26 14 d ago also EUVD-2026-62598

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

Patch / fix

  • Red Hat multicluster engine for Kubernetes 2.10 1787173361
  • Red Hat multicluster engine for Kubernetes 2.11 1787276784
  • Red Hat multicluster engine for Kubernetes 2.17 1786983349
  • Red Hat multicluster engine for Kubernetes 2.6 1787275318
  • Red Hat multicluster engine for Kubernetes 2.8 1787275519
  • Red Hat multicluster engine for Kubernetes 2.9 1787274923

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-66794 updated cvss 9.3

cluster-proxy-addon: cluster-proxy-addon: unauthenticated SSRF to arbitrary managed-cluster services via public Route

  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/cluster-proxy-addon-rhel9 1787275318
    fixed: vendor fix RHSA-2026:59579
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/cluster-proxy-addon-rhel9 1787275519
    fixed: vendor fix RHSA-2026:59558
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/cluster-proxy-addon-rhel9 1787274923
    fixed: vendor fix RHSA-2026:59559
  • Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/cluster-proxy-addon-rhel9 1787173361
    fixed: vendor fix RHSA-2026:59557
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/cluster-proxy-rhel9 1787276784
    fixed: vendor fix RHSA-2026:59556
  • Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/cluster-proxy-rhel9 1786983349
    fixed: vendor fix RHSA-2026:59593
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hive-rhel9 1787291123, multicluster-engine/work-rhel9 1787263188, multicluster-engine/discovery-rhel9 1787263531, multicluster-engine/placement-rhel9 1787260699, multicluster-engine/console-mce-rhel9 1787264250, multicluster-engine/must-gather-rhel9 1787264198, +20 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1787291250, multicluster-engine/work-rhel9 1787259113, multicluster-engine/discovery-rhel9 1787259074, multicluster-engine/placement-rhel9 1787259108, multicluster-engine/console-mce-rhel9 1787259048, multicluster-engine/must-gather-rhel9 1787258992, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hive-rhel9 1787205132, multicluster-engine/work-rhel9 1786933545, multicluster-engine/discovery-rhel9 1786658519, multicluster-engine/placement-rhel9 1786491555, multicluster-engine/console-mce-rhel9 1787079359, multicluster-engine/must-gather-rhel9 1786837240, +23 more Red Hat multicluster engine for Kubernetes 2.10 multicluster-engine/hive-rhel9 1787205371, multicluster-engine/work-rhel9 1786933256, multicluster-engine/discovery-rhel9 1787071404, multicluster-engine/placement-rhel9 1786548467, multicluster-engine/console-mce-rhel9 1787079364, multicluster-engine/must-gather-rhel9 1786548899, +24 more Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hive-rhel9 1787291933, multicluster-engine/work-rhel9 1786907276, multicluster-engine/discovery-rhel9 1786911975, multicluster-engine/placement-rhel9 1786911984, multicluster-engine/console-mce-rhel9 1787065052, multicluster-engine/must-gather-rhel9 1786911926, +25 more Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/hive-rhel9 1787033495, multicluster-engine/work-rhel9 1786933423, multicluster-engine/maestro-rhel9 1786985023, multicluster-engine/discovery-rhel9 1786681989, multicluster-engine/placement-rhel9 1786983381, multicluster-engine/console-mce-rhel9 1786668856, +28 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Affected products

  • Red Hat multicluster engine for Kubernetes 2.10
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.17
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.