Red Hat has revealed a significant security flaw, identified as CVE-2026-66794, within its Kubernetes management software. This vulnerability, marked as a high-severity Server-Side Request Forgery (SSRF) issue, impacts the cluster-proxy-addon element of the Multicluster Engine for Kubernetes.
Vulnerability Details and Risks
Assessed with a CVSS v3.1 score of 9.3, the flaw poses a considerable risk by potentially allowing remote attackers, without authentication, to access otherwise restricted services across managed Kubernetes clusters. The vulnerability arises from a publicly accessible route in the cluster proxy add-on that inadequately implements authentication and authorization, enabling unauthorized request forwarding.
Exploiting this route, attackers can manipulate URL paths, directing the proxy to contact arbitrary services within the managed clusters. This scenario exemplifies CWE-918, where attackers use the vulnerable proxy to indirectly target internal services, circumventing internet-based attacks.
Implications for Clusters
The proxy’s trusted status within internal systems means it can bypass network controls, service exposure limits, and cluster segmentation protections. In a multicluster Kubernetes setup, this vulnerability is particularly alarming due to the management components’ connectivity to multiple clusters.
Once a vulnerable route is exploited, attackers might gain access to internal APIs, harvest sensitive data, and interact with services not intended for external access. For instance, if an internal service returns data such as configurations or tokens without further authentication, it could aid attackers in escalating their intrusion efforts.
Mitigation and Recommendations
Despite the high CVSS score, Red Hat categorizes the issue as Important rather than Critical, highlighting the lack of remote code execution potential. Their analysis identifies high confidentiality impact, minor integrity impact, and no availability impact.
The affected components include multicluster-engine/cluster-proxy-addon-rhel9 and multicluster-engine/cluster-proxy-rhel9. Red Hat advises organizations to immediately limit network access to the susceptible cluster-proxy-addon route. Implementing firewall rules or similar network controls is crucial to ensure only trusted networks and authorized users can access the exposed port.
Administrators are urged to assess route exposure, scrutinize proxy access logs for unusual activity, and identify sensitive internal services that might be reachable from the management environment. Proactive measures can prevent exploitation and safeguard against potential breaches.
Stay ahead of threats by integrating threat intelligence into your security operations center and enhancing incident response capabilities.
