CVE-2026-7163: Cleartext Storage of Sensitive Information in Red Hat multicluster engine for Kubernetes 2.1
A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.
AI Analysis
Technical Summary
The vulnerability exists in the assisted-service REST API of the Multicluster Engine (MCE) for Kubernetes version 2.10, specifically in the local authentication mode (AUTH_TYPE=local) used in on-premises ACM/MCE hub deployments. An authenticated user with minimal namespace-scoped privileges can access the kubeadmin password and kubeconfig for arbitrary clusters via endpoints that return these credentials. The local authenticator grants full administrative access to any request bearing a valid JWT token, which is embedded as a plaintext query parameter in URLs accessible to users with get rights on InfraEnv objects in their namespaces. This flaw allows escalation to unrestricted root-level administrative access on any spoke cluster provisioned through the affected hub. The hosted SaaS offering (console.redhat.com) is not affected as it uses a different authentication mode. No official fix or patch is currently documented in the vendor advisory.
Potential Impact
Successful exploitation grants an attacker unrestricted root-level administrative access to any OpenShift cluster provisioned through the affected Multicluster Engine hub. This includes obtaining the kubeadmin password and kubeconfig files, enabling full control over cluster operations. The vulnerability affects on-premises deployments using local authentication mode and does not impact the hosted SaaS offering. The CVSS score is 6.1 (medium severity), reflecting the requirement for authenticated access but the high impact of credential exposure and cluster takeover.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory does not currently list any fixes or patches for this vulnerability. Users should monitor Red Hat's official security advisories for updates. Since the vulnerability involves exposure of JWT tokens in URLs and unrestricted local authentication, consider restricting access to InfraEnv objects and reviewing namespace permissions to limit exposure. Additionally, evaluate alternative authentication modes if feasible. No vendor-stated 'no action required' or 'already mitigated' statements are present.
CVE-2026-7163: Cleartext Storage of Sensitive Information in Red Hat multicluster engine for Kubernetes 2.1
Description
A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.
CVSS v3.1
Score 6.1medium
Affected software
Red Hat
multicluster engine for Kubernetes 2.1
Red Hat
multicluster engine for Kubernetes 2.11
Red Hat
multicluster engine for Kubernetes 2.7
Red Hat
multicluster engine for Kubernetes 2.7
Red Hat
multicluster engine for Kubernetes 2.9
Red Hat
multicluster engine for Kubernetes 2.9
pkg:rpm/redhat/multicluster-enginepkg:github/assisted-serviceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the assisted-service REST API of the Multicluster Engine (MCE) for Kubernetes version 2.10, specifically in the local authentication mode (AUTH_TYPE=local) used in on-premises ACM/MCE hub deployments. An authenticated user with minimal namespace-scoped privileges can access the kubeadmin password and kubeconfig for arbitrary clusters via endpoints that return these credentials. The local authenticator grants full administrative access to any request bearing a valid JWT token, which is embedded as a plaintext query parameter in URLs accessible to users with get rights on InfraEnv objects in their namespaces. This flaw allows escalation to unrestricted root-level administrative access on any spoke cluster provisioned through the affected hub. The hosted SaaS offering (console.redhat.com) is not affected as it uses a different authentication mode. No official fix or patch is currently documented in the vendor advisory.
Potential Impact
Successful exploitation grants an attacker unrestricted root-level administrative access to any OpenShift cluster provisioned through the affected Multicluster Engine hub. This includes obtaining the kubeadmin password and kubeconfig files, enabling full control over cluster operations. The vulnerability affects on-premises deployments using local authentication mode and does not impact the hosted SaaS offering. The CVSS score is 6.1 (medium severity), reflecting the requirement for authenticated access but the high impact of credential exposure and cluster takeover.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory does not currently list any fixes or patches for this vulnerability. Users should monitor Red Hat's official security advisories for updates. Since the vulnerability involves exposure of JWT tokens in URLs and unrestricted local authentication, consider restricting access to InfraEnv objects and reviewing namespace permissions to limit exposure. Additionally, evaluate alternative authentication modes if feasible. No vendor-stated 'no action required' or 'already mitigated' statements are present.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-04-27T04:21:23.911Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-7163","vendor":"Red Hat"}]
Threat ID: 69f365d8cbff5d8610ec502b
Added to database: 04/30/2026, 14:23:20 UTC
Last enriched: 08/15/2026, 14:24:22 UTC
Last updated: 09/14/2026, 10:01:33 UTC
Views: 146
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.