CVE-2026-75569: Reliance on Insufficiently Trustworthy Component in Red Hat multicluster engine for Kubernetes 2.10

The vulnerability CVE-2026-75569 affects the mce-operator-bundle component of Red Hat multicluster engine for Kubernetes 2.10. During the build process, scripts are fetched and executed from a remote repository without performing integrity checks such as commit pinning or signature verification. This flaw enables a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build, compromising the build process and potentially resulting in malicious software distribution. The CVSS 3.1 base score is 7.7 (high severity) with network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with scope changed.

If exploited, this vulnerability allows an attacker with write access to the remote repository to inject arbitrary code into the build process of the multicluster engine for Kubernetes. This can lead to compromised builds and distribution of malicious software, affecting the confidentiality and integrity of the system. There are no known exploits in the wild at this time.

Red Hat has issued security advisories (RHSA-2026:59634, RHSA-2026:59636, RHSA-2026:59638, RHSA-2026:59642, RHSA-2026:59643) addressing this vulnerability. Users should apply the updates provided in these advisories to remediate the issue. The advisories include updated images and fixes for the multicluster engine for Kubernetes. Refer to Red Hat's official documentation and advisories for installation and update instructions. Patch status is confirmed by the vendor advisories.