CVE-2026-19130
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster and knowledge of a prior credential value could exploit an authorization bypass. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure.
Risk Assessment
Risk of unauthorized access to sensitive credentials, potentially leading to cluster compromise.
Recommendation
Update multicluster-engine to a version that includes the authorization bypass fix.
Other vulnerabilities in multicluster-engine
See all- CVE-2026-73266High
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels, forcing a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.
- CVE-2026-7163Medium
A vulnerability in the assisted-service REST API, an optional Assisted Installer component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, which unconditionally grants full administrative access to any request bearing a valid JWT. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace.
Original NVD description (English source)
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS