CVE-2026-66794 Red Hat CVE debrief

Who should care

Organizations using Multicluster Engine for Kubernetes, administrators of Kubernetes clusters, and security teams responsible for monitoring and patching vulnerabilities in their infrastructure should prioritize patching the `cluster-proxy-addon` component to prevent potential unauthorized access to internal services. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets.

Technical summary

CVE-2026-66794 is a critical vulnerability in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. An unauthenticated attacker can manipulate URL path segments to proxy requests to arbitrary services across any managed cluster, potentially leading to information disclosure or further compromise of the cluster environment. The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. Affected product deployments should be identified, and owners assigned for follow-up.

Defensive priority

Organizations using Multicluster Engine for Kubernetes should prioritize patching the `cluster-proxy-addon` component to prevent potential unauthorized access to internal services.

Recommended defensive actions

• Apply patches for the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes
• Restrict access to user-facing routes to minimize exposure
• Monitor for suspicious activity related to proxy requests across managed clusters
• Review and update authentication and authorization configurations for managed clusters
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE-2026-66794 record indicates a critical vulnerability in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes, allowing unauthenticated attackers to bypass authentication and authorization checks. Evidence is based on official CVE and NVD records, as well as references from Red Hat security advisories. Defenders should verify affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations. They should also check for compensating controls and monitor for suspicious activity.

Official resources