Red Hat Multicluster Engine For Kubernetes 2.10 vulnerabilities

9 CVEs affecting Red Hat Multicluster Engine For Kubernetes 2.10, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-73267, published 2026-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-73268, published 2026-08-12. Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job…
CVE-2026-73267, published 2026-08-21. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by…
CVE-2026-66794, published 2026-08-19. Critical severity, CVSS 9.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass…
CVE-2026-75569, published 2026-08-19. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification.…
CVE-2026-17107, published 2026-07-24. High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation…
CVE-2026-73269, published 2026-08-12. Critical severity, CVSS 9.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped…
CVE-2026-66795, published 2026-08-17. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name…
CVE-2026-19130, published 2026-08-12. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value,…
CVE-2026-73266, published 2026-08-13. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the…