Skip to content
Threat Feed
Subscribe

Product

Multicluster-Engine

3 briefs RSS
low advisory

Authorization Flaw in Red Hat Multicluster Engine Clusterclaims-controller

A vulnerability in the Red Hat multicluster engine (MCE) allows authenticated tenants to delete unauthorized ManagedCluster resources due to a missing ownership check in the clusterclaims-controller.

multicluster engine
1t 1c
critical advisory

Privilege Escalation in Red Hat Advanced Cluster Management

An insecure configuration in the Red Hat Advanced Cluster Management Application Subscription controller allows users with namespace-scoped edit privileges to escalate to cluster-admin by deploying unauthorized cluster-scoped resources via Helm charts.

Advanced Cluster Management for Kubernetes +1 privilege-escalation kubernetes cve vulnerability cloud credential-access
2t 2c updated
high advisory

Red Hat Advanced Cluster Management Vulnerability Allows Cluster-Admin Privilege Escalation

A flaw exists in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE), allowing an authenticated hub principal to inject an Impersonate-Group header into proxied requests, bypassing validation, and leveraging the spoke ServiceAccount's unrestricted impersonation permissions to escalate privileges to cluster-admin on all managed clusters.

Red Hat Advanced Cluster Management for Kubernetes +1 privilege-escalation vulnerability kubernetes cloud red-hat
1t 1c