Red Hat Multicluster Engine For Kubernetes vulnerabilities

18 CVEs affecting Red Hat Multicluster Engine For Kubernetes, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71299, published 2026-10-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-3727, published 2024-05-14. High severity, CVSS 8.3. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion,…
CVE-2026-44724, published 2026-05-27. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active…
CVE-2026-16242, published 2026-07-20. Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent…
CVE-2026-35469, published 2026-04-16. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before…
CVE-2024-12401, published 2024-12-12. Medium severity, CVSS 4.4. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the cert-manager package. This flaw allows an attacker who can modify PEM data that the cert-manager reads, for example, in a Secret resource, to use large amounts of CPU in the…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2025-69873, published 2026-02-11. Low severity, CVSS 2.9. EPSS: 0.5% chance of exploitation in the next 30 days. ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON…
CVE-2025-2241, published 2025-03-17. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object…
CVE-2026-101919, published 2026-10-05. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper…
CVE-2026-71299, published 2026-10-05. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as…

Latest

CVE-2026-71298, published 2026-10-05. Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require…
CVE-2026-71297, published 2026-10-05. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to…
CVE-2026-75924, published 2026-08-18. High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can…
CVE-2026-41567, published 2026-06-05. High severity, CVSS 7.2. EPSS: 0.2% chance of exploitation in the next 30 days. Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT…
CVE-2026-10805, published 2026-06-04. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A…
CVE-2026-10101, published 2026-05-29. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view`…