5.8
Moyenne
CVE-2026-19130 A flaw was found in the provider-credential-controller component of multicluster-engine (MCE)
Description
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Multicluster Engine for Kubernetes | Versions non publiées | |
| multicluster engine for Kubernetes 2.10 1787176886 | premières → < 1787176886 | 1787176886 |
| multicluster engine for Kubernetes 2.11 1787239595 | premières → < 1787239595 | 1787239595 |
| multicluster engine for Kubernetes 2.17 1786664288 | premières → < 1786664288 | 1786664288 |
| multicluster engine for Kubernetes 2.6 1787260821 | premières → < 1787260821 | 1787260821 |
| multicluster engine for Kubernetes 2.8 1787259099 | premières → < 1787259099 | 1787259099 |
| multicluster engine for Kubernetes 2.9 1787176716 | premières → < 1787176716 | 1787176716 |
| multicluster engine for Kubernetes 2.1 1787176886 | premières → < 1787176886 | 1787176886 |
| multicluster engine for Kubernetes 2.9.0 1787176716 | premières → < 1787176716 | 1787176716 |
Autres CVE de Multicluster Engine for Kubernetes
Les 79 CVE de Multicluster Engine for Kubernetes →
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Moyenne
CVE-2026-114236
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
3.3
Faible
CVE-2026-71297
A flaw was found in the maestro gRPC broker
5.4
Moyenne
CVE-2026-71299
A flaw was found in Maestro
6.5
Moyenne