CVE-2026-17107
High
Description
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
SeverityHigh
CVSS8.5
Exploit probability—
ProductMulticluster Engine 2.10
PublishedJul 24, 2026
First seenJul 24, 2026
Weakness typeCWE-441CWE-441
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| multicluster_engine 2.10 | No range specified | — |
| multicluster_engine 2.11 | No range specified | — |
| multicluster_engine 2.17 | No range specified | — |
| multicluster_engine 2.6 | No range specified | — |
| multicluster_engine 2.8 | No range specified | — |
| multicluster_engine 2.9 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.