Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-17107

Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat multicluster engine for Kubernetes 2.10

Default version status: affected

  • 1784342329 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.10

Default version status: affected

  • 1784342329 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.11

Default version status: affected

  • 1784925025 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.17

Default version status: affected

  • 1784926298 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.6

Default version status: affected

  • 1783985960 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.8

Default version status: affected

  • 1784342329 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.9

Default version status: affected

  • 1783278220 to < *unaffected

References