Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-66795

Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat multicluster engine for Kubernetes 2.10

Default version status: affected

  • 1787078272 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.11

Default version status: affected

  • 1787078330 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.17

Default version status: affected

  • 1786577915 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.6

Default version status: affected

  • 1787260779 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.8

Default version status: affected

  • 1787259044 to < *unaffected

Red Hat multicluster engine for Kubernetes 2.9

Default version status: affected

  • 1787078307 to < *unaffected

References