Privilege Escalation in managedcluster-import-controller

A high-severity vulnerability (CVE-2026-66795) has been identified in the managedcluster-import-controller. The vulnerability exists within the Certificate Signing Request (CSR) auto-approval logic, which fails to adequately validate incoming CSRs. Specifically, the controller does not inspect the signer name or perform necessary decoding of the PEM-encoded x509 CSR before processing.

This flaw allows an attacker who has compromised a privileged service account on a spoke cluster to submit a malicious CSR to the central hub cluster. Because the validation logic is insufficient, the hub cluster may process this request, enabling the attacker to obtain administrative credentials or elevated access rights. Given the criticality of hub-spoke cluster architectures in multi-cluster management, this vulnerability represents a significant risk for unauthorized control over managed environments. Defenders should ensure the controller is patched and monitor for unusual CSR submission patterns originating from existing spoke cluster service accounts.

Impact

Successful exploitation of CVE-2026-66795 results in privilege escalation, allowing an attacker to move from a compromised spoke cluster service account to administrative control over the central hub cluster. This can facilitate unauthorized access to cluster secrets, control over additional spoke clusters, and potential data exfiltration within the managed environment.

Recommendation

• Apply the vendor-provided security update for the managedcluster-import-controller immediately.
• Review and audit the permissions associated with all service accounts on spoke clusters that have communication channels with the hub.
• Monitor CSR request logs on the hub cluster for requests containing anomalous attributes or originating from unexpected spoke cluster service accounts.