multicluster engine for Kubernetes 2.17 vulnerabilities

Product

multicluster engine for Kubernetes 2.17

by Red Hat · last CVE Aug 21, 2026

CVEs

On KEV

9.9

Max CVSS

New 30D

Severity mix

Critical 6High 7Medium 3Low 0

Severity

Exploitation

Watch

Add multicluster engine for Kubernetes 2.17 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-66795	9.9	0%	Aug 17	Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) Affected: All versions, or not specified
CVE-2026-73268	9.9	1%	Aug 12	Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection Affected: All versions, or not specified
CVE-2026-73269	9.9	1%	Aug 12	Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa Affected: All versions, or not specified
CVE-2026-16242	9.4	1%	Jul 20	Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates Affected: All versions, or not specified
CVE-2026-66794	9.3	1%	Aug 19	Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route Affected: All versions, or not specified
CVE-2026-44990	9.3	1%	Jun 12	Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` Affected: All versions, or not specified