CVE-2026-66795: Improper Certificate Validation in Red Hat Multicluster Engine for Kubernetes
CVE-2026-66795 is a critical vulnerability in Red Hat OpenShift Multicluster Engine's managedcluster-import-controller. The flaw involves improper validation of Certificate Signing Requests (CSRs) in the auto-approval logic, specifically failing to inspect the signer name or decode the PEM-encoded x509 CSR. This allows a privileged service account on a spoke cluster to submit a malicious CSR, potentially escalating privileges to obtain administrative credentials on the hub cluster. No official fix or mitigation currently meets Red Hat's criteria for deployment and stability.
AI Analysis
Technical Summary
The managedcluster-import-controller component in Red Hat OpenShift Multicluster Engine improperly validates incoming CSRs during the auto-approval process. It does not verify the signer name or decode the PEM-encoded x509 CSR, enabling a privileged service account on a spoke cluster to submit a malicious CSR. Exploiting this vulnerability can lead to privilege escalation, granting cluster-admin privileges on the hub cluster. Red Hat has published an advisory confirming the vulnerability and its critical impact but currently does not offer an official fix or mitigation that meets their standards for ease of use, applicability, and stability.
Potential Impact
Successful exploitation allows an attacker with a privileged service account on a spoke cluster to escalate privileges and obtain administrative credentials on the hub cluster. This compromises the security of the multicluster environment, potentially allowing full control over the hub cluster and impacting confidentiality, integrity, and availability.
Mitigation Recommendations
Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates and consider engaging Red Hat Technical Account Managers for guidance. No workaround or temporary fix is currently recommended by Red Hat.
CVE-2026-66795: Improper Certificate Validation in Red Hat Multicluster Engine for Kubernetes
Description
CVE-2026-66795 is a critical vulnerability in Red Hat OpenShift Multicluster Engine's managedcluster-import-controller. The flaw involves improper validation of Certificate Signing Requests (CSRs) in the auto-approval logic, specifically failing to inspect the signer name or decode the PEM-encoded x509 CSR. This allows a privileged service account on a spoke cluster to submit a malicious CSR, potentially escalating privileges to obtain administrative credentials on the hub cluster. No official fix or mitigation currently meets Red Hat's criteria for deployment and stability.
CVSS v3.1
Score 9.1critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The managedcluster-import-controller component in Red Hat OpenShift Multicluster Engine improperly validates incoming CSRs during the auto-approval process. It does not verify the signer name or decode the PEM-encoded x509 CSR, enabling a privileged service account on a spoke cluster to submit a malicious CSR. Exploiting this vulnerability can lead to privilege escalation, granting cluster-admin privileges on the hub cluster. Red Hat has published an advisory confirming the vulnerability and its critical impact but currently does not offer an official fix or mitigation that meets their standards for ease of use, applicability, and stability.
Potential Impact
Successful exploitation allows an attacker with a privileged service account on a spoke cluster to escalate privileges and obtain administrative credentials on the hub cluster. This compromises the security of the multicluster environment, potentially allowing full control over the hub cluster and impacting confidentiality, integrity, and availability.
Mitigation Recommendations
Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory for updates and consider engaging Red Hat Technical Account Managers for guidance. No workaround or temporary fix is currently recommended by Red Hat.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-27T17:51:24.886Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-66795","vendor":"Red Hat"}]
Threat ID: 6a83758abf8831d5398e092b
Added to database: 08/17/2026, 20:56:42 UTC
Last enriched: 08/17/2026, 21:11:09 UTC
Last updated: 08/18/2026, 02:41:01 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.