CVE-2026-66794: Server-Side Request Forgery (SSRF) in Red Hat multicluster engine for Kubernetes 2.10
Description
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
CVSS v3.1
Score 9.3critical
Affected software
Red Hat
multicluster engine for Kubernetes 2.10
Red Hat
multicluster engine for Kubernetes 2.11
Red Hat
multicluster engine for Kubernetes 2.17
Red Hat
multicluster engine for Kubernetes 2.6
Red Hat
multicluster engine for Kubernetes 2.8
Red Hat
multicluster engine for Kubernetes 2.9
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the cluster-proxy-addon component of Red Hat multicluster engine for Kubernetes 2.10. An unauthenticated attacker who can reach the user-facing route can bypass authentication and authorization checks by manipulating URL path segments. This allows proxying requests to arbitrary services in any managed cluster, enabling unauthorized access to internal services that are normally protected. The flaw is tracked as CVE-2026-66794 with a CVSS 3.1 score of 9.3 (critical). Red Hat has published an advisory and released multicluster engine for Kubernetes v2.11.6 with security fixes addressing this and other vulnerabilities.
Potential Impact
An unauthenticated attacker can bypass authentication and authorization controls to proxy requests to internal services across managed Kubernetes clusters. This can lead to unauthorized information disclosure and potentially further compromise of the cluster environment. The vulnerability has a critical severity rating with a CVSS score of 9.3, indicating high impact on confidentiality and partial impact on integrity, without affecting availability.
Mitigation Recommendations
Red Hat has released multicluster engine for Kubernetes version 2.11.6 which includes security fixes addressing this vulnerability. Users should upgrade to version 2.11.6 or later to remediate this issue. Refer to the official Red Hat advisory (RHSA-2026:59556) and documentation for installation and upgrade instructions. No other mitigations are specified in the advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-27T17:51:24.886Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-66794","vendor":"Red Hat"}]
Threat ID: 6a85eb30acd9273b49667224
Added to database: 08/19/2026, 17:43:12 UTC
Last enriched: 09/30/2026, 04:46:43 UTC
Last updated: 10/04/2026, 10:10:00 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.