multicluster engine for Kubernetes 2.10 vulnerabilities

Product

multicluster engine for Kubernetes 2.10

by Red Hat · last CVE Aug 21, 2026

CVEs

On KEV

9.9

Max CVSS

New 30D

Severity mix

Critical 4High 4Medium 1Low 0

Severity

Exploitation

Watch

Add multicluster engine for Kubernetes 2.10 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-66795	9.9	0%	Aug 17	Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) Affected: All versions, or not specified
CVE-2026-73268	9.9	1%	Aug 12	Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection Affected: All versions, or not specified
CVE-2026-73269	9.9	1%	Aug 12	Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa Affected: All versions, or not specified
CVE-2026-66794	9.3	1%	Aug 19	Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route Affected: All versions, or not specified