Red Hat Multicluster Engine For Kubernetes 2.9 vulnerabilities

15 CVEs affecting Red Hat Multicluster Engine For Kubernetes 2.9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-73267, published 2026-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-16242, published 2026-07-20. Critical severity, CVSS 9.4. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent…
CVE-2026-73268, published 2026-08-12. Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job…
CVE-2026-44990, published 2026-06-12. Critical severity, CVSS 9.3. EPSS: 0.7% chance of exploitation in the next 30 days. ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html`…
CVE-2026-12143, published 2026-06-12. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
CVE-2026-10059, published 2026-08-05. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced…
CVE-2026-73267, published 2026-08-21. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by…
CVE-2026-66794, published 2026-08-19. Critical severity, CVSS 9.3. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass…
CVE-2026-75569, published 2026-08-19. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification.…
CVE-2026-27145, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the…
CVE-2026-17107, published 2026-07-24. High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation…

Latest

CVE-2026-66795, published 2026-08-17. Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name…
CVE-2026-73266, published 2026-08-13. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the…
CVE-2026-19130, published 2026-08-12. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value,…
CVE-2026-73269, published 2026-08-12. Critical severity, CVSS 9.9. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped…