Skip to content
Fencer Vulns
medium 6.1

CVE-2026-7163 json

Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

published 2026-04-30 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-26374

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub.

The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace.

The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode.

Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.

Patch / fix

  • Red Hat multicluster engine for Kubernetes 2.1 1776983527
  • Red Hat multicluster engine for Kubernetes 2.11 1776987609
  • Red Hat multicluster engine for Kubernetes 2.7 1777205772, 1777205801
  • Red Hat multicluster engine for Kubernetes 2.9 1778464072, 1778464111

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-7163 updated cvss 6.1

assisted-service: assisted-service: Authenticated users can gain administrative access to OpenShift clusters via credential disclosure

  • Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine 1776983527
    fixed: vendor fix RHSA-2026:12116
  • Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine 1777205772, multicluster-engine 1777205801
    fixed: vendor fix RHSA-2026:11511
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1778464072, multicluster-engine 1778464111
    fixed: vendor fix RHSA-2026:18584
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine 1776987609
    fixed: vendor fix RHSA-2026:12337
  • Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine 1773487346, multicluster-engine 1776351169, multicluster-engine 1776949906, multicluster-engine 1776949909 Red Hat multicluster engine for Kubernetes 2.7 multicluster-engine 1777360145, multicluster-engine 1777360530, multicluster-engine 1777360557, multicluster-engine 1777360597 Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine 1778504033, multicluster-engine 1778504202, multicluster-engine 1778504234, multicluster-engine 1778504285 Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine 1776773976, multicluster-engine 1776950029, multicluster-engine 1776950044, multicluster-engine 1776967957
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CISA ADP 3.1 6.1 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.7
  • Red Hat multicluster engine for Kubernetes 2.9

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.