CVE-2026-19130: Authorization Bypass Through User-Controlled Key in Red Hat multicluster engine for Kubernetes 2.10

This vulnerability exists in the provider-credential-controller component of Red Hat multicluster engine (MCE) for Kubernetes version 2.10. An attacker who has specific permissions on the hub cluster and knowledge of a previous credential value can exploit an authorization bypass by manipulating 'copiedFrom' labels. This manipulation allows the attacker to intercept newly rotated provider credentials, resulting in unauthorized access to sensitive credential information that should be protected.

Successful exploitation leads to unauthorized disclosure of sensitive provider credentials by bypassing authorization controls. This compromises confidentiality of credentials managed by the multicluster engine, potentially allowing further unauthorized access to managed Kubernetes clusters or cloud resources.

Red Hat has released updated multicluster engine for Kubernetes images in version 2.11.6 that include security fixes addressing this vulnerability. Users should upgrade to version 2.11.6 or later to remediate this issue. Refer to Red Hat's official advisory RHSA-2026:59556 for installation and upgrade instructions. No temporary or alternative mitigations are specified; applying the official update is the recommended remediation.