CVE-2026-19130: Red Hat Multicluster Engine For Kubernetes 2.10

Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

Affected products

• Red Hat Multicluster Engine For Kubernetes 2.10: before 1787176886 (fixed in 1787176886)
• Red Hat Multicluster Engine For Kubernetes 2.11: before 1787239595 (fixed in 1787239595)
• Red Hat Multicluster Engine For Kubernetes 2.17: before 1786664288 (fixed in 1786664288)
• Red Hat Multicluster Engine For Kubernetes 2.6: before 1787260821 (fixed in 1787260821)
• Red Hat Multicluster Engine For Kubernetes 2.8: before 1787259099 (fixed in 1787259099)
• Red Hat Multicluster Engine For Kubernetes 2.9: before 1787176716 (fixed in 1787176716)

Published 2026-08-12. Last modified 2026-09-29.