CVE-2026-66795

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-66795", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-07-27T17:51:24.886Z", "datePublished": "2026-08-17T20:45:33.786Z", "dateUpdated": "2026-09-29T19:41:20.174Z"}, "containers": {"cna": {"title": "Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke\u2192hub cluster-admin)", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster."}], "affected": [{"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787078272", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787078330", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1786577915", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787260779", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787259044", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"]}, {"vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "defaultStatus": "affected", "versions": [{"version": "1787078307", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "name": "RHSA-2026:59593", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-66795", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507540", "name": "RHBZ#2507540", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-08-17T20:29:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-295: Improper Certificate Validation", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-17T20:29:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T19:41:20.174Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-18T15:15:25.705433Z", "id": "CVE-2026-66795", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T15:15:40.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-66795", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T15:15:25.705433Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-18T15:15:36.242Z"}}], "cna": {"title": "Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke\u2192hub cluster-admin)", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.10", "versions": [{"status": "unaffected", "version": "1787078272", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.11", "versions": [{"status": "unaffected", "version": "1787078330", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.17", "versions": [{"status": "unaffected", "version": "1786577915", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.6", "versions": [{"status": "unaffected", "version": "1787260779", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.8", "versions": [{"status": "unaffected", "version": "1787259044", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "vendor": "Red Hat", "product": "multicluster engine for Kubernetes 2.9", "versions": [{"status": "unaffected", "version": "1787078307", "lessThan": "*", "versionType": "rpm"}], "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-07-27T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-08-17T20:29:00.000Z", "value": "Made public."}], "datePublic": "2026-08-17T20:29:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:59556", "name": "RHSA-2026:59556", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59557", "name": "RHSA-2026:59557", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59558", "name": "RHSA-2026:59558", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59559", "name": "RHSA-2026:59559", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59579", "name": "RHSA-2026:59579", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:59593", "name": "RHSA-2026:59593", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-66795", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507540", "name": "RHBZ#2507540", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-29T19:41:20.174Z"}, "x_redhatCweChain": "CWE-295: Improper Certificate Validation"}}, "cveMetadata": {"cveId": "CVE-2026-66795", "state": "PUBLISHED", "dateUpdated": "2026-09-29T19:41:20.174Z", "dateReserved": "2026-07-27T17:51:24.886Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-08-17T20:45:33.786Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.10::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787078272", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.11::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.11", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787078330", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.17::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786577915", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.6::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.6", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787260779", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.8::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787259044", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:multicluster_engine:2.9::el9"], "defaultStatus": "affected", "packageName": "multicluster-engine/managedcluster-import-controller-rhel9", "product": "multicluster engine for Kubernetes 2.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787078307", "versionType": "rpm"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster."}], "id": "CVE-2026-66795", "lastModified": "2026-09-29T20:17:22.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-66795", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-18T15:15:25.705433Z", "version": "2.0.3"}}]}, "published": "2026-08-17T21:16:47.163", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59556"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59557"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59558"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59559"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59579"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:59593"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-66795"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507540"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "managedcluster-import-controller: managedcluster-import-controller: CSR auto-approver does not validate certificate Subject, signerName, or requester identity", "id": "2507540", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507540"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-66795", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_engine", "fix_state": "Affected", "package_name": "multicluster-engine/managedcluster-import-controller-rhel9", "product_name": "Multicluster Engine for Kubernetes"}], "public_date": "2026-08-17T20:29:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-66795\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-66795"], "statement": "Critical: The `managedcluster-import-controller` in Red Hat OpenShift Multicluster Engine is vulnerable to a privilege escalation flaw. A compromised spoke bootstrap Service Account can exploit insufficient validation in the CSR auto-approval process to gain `cluster-admin` privileges on the hub cluster. This poses a significant risk to the overall security of the multicluster environment.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Multicluster Engine for Kubernetes", "source": "cna", "vendor": "Red Hat"}, "product": "multicluster_engine", "vendor": "redhat"}], "created": "2026-08-18T00:00:04.890650+00:00", "updated": "2026-09-02T08:45:04.852186+00:00", "vendors": ["redhat", "redhat$PRODUCT$multicluster_engine"]}