multicluster engine for Kubernetes 2.6

2 results · Clear filters · Feed

• Medium 5.8
  CVE-2026-19130

  Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

  A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipul…

  Red Hat multicluster engine for Kubernetes 2.9 multicluster engine for Kubernetes 2.6 multicluster engine for Kubernetes 2.11
  Aug 12, 2026
• Medium 6.4
  CVE-2025-7195

  Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

  Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…

  Red Hat operator-framework Red Hat Advanced Cluster Management for Kubernetes 2.13 Red Hat Advanced Cluster Management for Kubernetes 2 Go
  Aug 7, 2025