CVE-2026-66795 Privilege escalation in multicluster engine for Kubernetes 2.10
A flaw in the managedcluster-import-controller allows a privileged spoke cluster service account to escalate privileges to hub cluster-admin by submitting a malicious CSR.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66795?
CVE-2026-66795 is a critical vulnerability in Red Hat multicluster engine for Kubernetes 2.10, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
Weakness: CWE-295
Which versions are affected by CVE-2026-66795?
How do I fix CVE-2026-66795?
No fix has been published for CVE-2026-66795 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66795 being exploited?
There is no known exploitation of CVE-2026-66795 in the wild and no public exploit code.
Sources
Also known as GHSA-w9c6-w29v-4vp6.