The vulnerability exists in the assisted-service REST API of Red Hat's Multicluster Engine for Kubernetes. In on-premises deployments using AUTH_TYPE=local, the local authenticator grants full administrative access to any request with a valid JWT token, without per-endpoint restrictions. This JWT token is embedded as a plaintext query parameter in URLs accessible to users with minimal namespace-scoped privileges. Consequently, an authenticated user with get rights on an InfraEnv object in their namespace can retrieve the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the hub, resulting in unrestricted root-level administrative access to those clusters. The hosted SaaS offering is not affected due to a different authentication mode. No patch or official remediation level is currently indicated in the vendor advisory.

Successful exploitation allows an attacker with minimal privileges to obtain administrative credentials (kubeadmin password and kubeconfig) for any OpenShift cluster provisioned through the affected Multicluster Engine hub. This grants unrestricted root-level administrative access to those clusters, potentially compromising cluster integrity and confidentiality. The vulnerability affects on-premises deployments using local authentication mode but does not impact the hosted SaaS offering.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7163 for current remediation guidance. Until an official fix is available, restrict access to InfraEnv objects and minimize the number of users with get rights on these objects. Consider alternative authentication modes if feasible. Monitor Red Hat communications for updates on patches or official mitigations.