CVE-2026-66794: Server-Side Request Forgery (SSRF) in Red Hat multicluster engine for Kubernetes 2.10

The vulnerability exists in the cluster-proxy-addon component of Red Hat multicluster engine for Kubernetes 2.10. An unauthenticated attacker who can access the user-facing route can bypass authentication and authorization checks by manipulating URL path segments. This allows the attacker to proxy requests to arbitrary services across any managed cluster, enabling unauthorized access to internal services that are normally protected. The vulnerability is identified as CWE-918 (Server-Side Request Forgery) and has a CVSS 3.1 base score of 9.3, indicating critical severity with high impact on confidentiality and low impact on integrity and no impact on availability. The vendor advisory references a security update in version 2.11.6 that addresses this issue.

An attacker can bypass authentication and authorization to proxy requests to internal services across managed Kubernetes clusters, potentially leading to unauthorized information disclosure and further compromise of the cluster environment. The vulnerability affects confidentiality (high impact) but has limited impact on integrity and no impact on availability.

Red Hat has released a security update in multicluster engine for Kubernetes version 2.11.6 that addresses this vulnerability. Users should upgrade to version 2.11.6 or later to remediate this issue. The vendor advisory does not indicate any temporary workarounds or that no action is required. Patch status is confirmed by the vendor advisory.