CVE-2026-66795 is a critical privilege escalation vulnerability in the managedcluster-import-controller component of Red Hat OpenShift Multicluster Engine. The issue arises because the CSR auto-approval logic does not validate the signerName field or decode the PEM-encoded x509 CSR, allowing a compromised privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation leads to cluster-admin privileges on the hub cluster, compromising the multicluster environment's security. Red Hat has confirmed the vulnerability but currently does not provide an official fix or mitigation that meets their standards for ease of use, applicability, and stability.

This vulnerability allows an attacker with access to a privileged service account on a spoke cluster to escalate privileges and gain administrative control over the hub cluster. This compromises the integrity, confidentiality, and availability of the multicluster environment, posing a significant security risk to Red Hat OpenShift Multicluster Engine deployments.

As per the Red Hat advisory, no official fix or mitigation currently meets the criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Until a fix is available, limiting access to privileged service accounts on spoke clusters and minimizing the attack surface may reduce risk, but no direct mitigation is officially recommended by Red Hat at this time.