CVE-2026-17107Published
Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster
cve-program · CVE-2026-17107
Publishedmulticluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.10",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784342329",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.10",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784342329",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.10::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784925025",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.17",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784926298",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.17::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.6",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1783985960",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.6::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1784342329",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
]
}multicluster-engine/cluster-proxy-rhel9
https://catalog.redhat.com/software/containers/
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "multicluster-engine/cluster-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1783278220",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.9::el9"
]
}Original source record · Cite this exact observation · Complete original publisher JSON