Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.7.10
Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.7.10 release that simplify the process of deploying OpenShift Container Platform clusters. The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters, or to import existing Kubernetes-based clusters for management. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
AI Analysis
Technical Summary
CVE-2026-7163 describes a security vulnerability in the assisted-service REST API, an optional component of the Multicluster Engine (MCE) for Kubernetes. In on-premises deployments using AUTH_TYPE=local authentication mode, any authenticated user with minimal namespace-scoped privileges can retrieve the kubeadmin password and kubeconfig for arbitrary OpenShift clusters provisioned through the hub. This is due to the local authenticator granting unconditional full administrative access to requests bearing a valid JWT, which is embedded as a plaintext query parameter in URLs accessible to users with get rights on InfraEnv objects. The vulnerability does not affect the hosted SaaS offering (console.redhat.com) which uses a different authentication mode. Successful exploitation grants root-level administrative access to the affected clusters. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information), CWE-131, and CWE-551. No fix has been released yet according to the vendor advisory, and remediation guidance is pending.
Potential Impact
An attacker with authenticated access and minimal namespace-scoped privileges can obtain administrative credentials (kubeadmin password and kubeconfig) for any OpenShift cluster provisioned through the affected hub. This grants unrestricted root-level administrative access to those clusters, potentially allowing full control over cluster resources and configurations. The vulnerability affects on-premises deployments of Multicluster Engine and Red Hat Advanced Cluster Management using local authentication mode. The hosted SaaS offering is not impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory does not indicate that a fix is currently available. Users should monitor Red Hat's official advisories for updates. Since the vulnerability arises from the use of AUTH_TYPE=local mode, consider evaluating alternative authentication configurations if feasible. Restricting access to InfraEnv objects and minimizing namespace-scoped privileges may reduce exposure. Contact Red Hat support or a Technical Account Manager for tailored guidance.
Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.7.10
Description
Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.7.10 release that simplify the process of deploying OpenShift Container Platform clusters. The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters, or to import existing Kubernetes-based clusters for management. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7163 describes a security vulnerability in the assisted-service REST API, an optional component of the Multicluster Engine (MCE) for Kubernetes. In on-premises deployments using AUTH_TYPE=local authentication mode, any authenticated user with minimal namespace-scoped privileges can retrieve the kubeadmin password and kubeconfig for arbitrary OpenShift clusters provisioned through the hub. This is due to the local authenticator granting unconditional full administrative access to requests bearing a valid JWT, which is embedded as a plaintext query parameter in URLs accessible to users with get rights on InfraEnv objects. The vulnerability does not affect the hosted SaaS offering (console.redhat.com) which uses a different authentication mode. Successful exploitation grants root-level administrative access to the affected clusters. The vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information), CWE-131, and CWE-551. No fix has been released yet according to the vendor advisory, and remediation guidance is pending.
Potential Impact
An attacker with authenticated access and minimal namespace-scoped privileges can obtain administrative credentials (kubeadmin password and kubeconfig) for any OpenShift cluster provisioned through the affected hub. This grants unrestricted root-level administrative access to those clusters, potentially allowing full control over cluster resources and configurations. The vulnerability affects on-premises deployments of Multicluster Engine and Red Hat Advanced Cluster Management using local authentication mode. The hosted SaaS offering is not impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory does not indicate that a fix is currently available. Users should monitor Red Hat's official advisories for updates. Since the vulnerability arises from the use of AUTH_TYPE=local mode, consider evaluating alternative authentication configurations if feasible. Restricting access to InfraEnv objects and minimizing namespace-scoped privileges may reduce exposure. Contact Red Hat support or a Technical Account Manager for tailored guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:11512
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-34986"]
- State
- PUBLISHED
Threat ID: 6a16095be29bf47b50624ee7
Added to database: 05/26/2026, 20:58:03 UTC
Last enriched: 08/14/2026, 19:17:31 UTC
Last updated: 09/15/2026, 01:45:45 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.