This vulnerability involves the cluster-proxy service-proxy component in Red Hat Advanced Cluster Management for Kubernetes and Multicluster Engine. The service-proxy appends impersonation group headers to proxied requests without first removing any existing caller-supplied headers. Because the spoke ServiceAccount has unrestricted impersonation permissions, an authenticated user on the hub can inject an Impersonate-Group header to escalate privileges to cluster-admin on every managed cluster. The CVSS 3.1 score is 8.5, indicating high severity. No official remediation level or patch information is provided in the vendor advisory, and no known exploits are reported in the wild.

An authenticated principal on the hub can escalate privileges to cluster-admin on all managed clusters by injecting impersonation headers. This leads to full control over the affected Kubernetes clusters, impacting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17107 for current remediation guidance. Until an official fix is available, restrict access to the hub to trusted users only and monitor for suspicious impersonation header usage if possible.