CVE-2026-75569: Reliance on Insufficiently Trustworthy Component in Red Hat multicluster engine for Kubernetes 2.10

The multicluster engine for Kubernetes provides centralized management for multiple Kubernetes clusters. CVE-2026-75569 is a vulnerability in the mce-operator-bundle build process where build scripts are fetched from a mutable remote repository branch without commit pinning or signature verification. This lack of integrity checks allows an attacker with write access to the remote repository to inject and execute arbitrary code during the build, compromising the build process and potentially the integrity of the resulting software. The vulnerability introduces a supply chain risk and is rated as Important by Red Hat. The issue affects versions >=2.1 <2.9.7 and >=2.10 <2.10.6. Red Hat has released version 2.9.7 with security fixes. No runtime mitigations are available because the vulnerability is in the build process itself.

The vulnerability allows a malicious actor with write access to the remote repository used in the build process to inject arbitrary code, compromising the build integrity and potentially leading to distribution of malicious software. This impacts the trustworthiness of the multicluster engine for Kubernetes software delivered by Red Hat. There is no indication of active exploitation in the wild. The impact is on confidentiality and integrity of the software supply chain, with no direct availability impact.

This vulnerability resides in the build process of the mce-operator-bundle and cannot be mitigated by runtime configuration changes. Users should upgrade to Red Hat multicluster engine for Kubernetes version 2.9.7 or later, which includes security fixes addressing this issue. Follow Red Hat's documentation for installing updated images. No direct operational mitigations exist for deployed products. Monitoring for updated advisories from Red Hat is recommended.