Red Hat has disclosed CVE-2026-66794, an important-severity server-side request forgery vulnerability affecting the cluster-proxy-addon component in Multicluster Engine for Kubernetes.
The flaw, published on August 19, 2026, carries a CVSS v3.1 score of 9.3 and could allow unauthenticated remote attackers to access services that would otherwise remain isolated inside connected managed clusters.
Tracked under CWE-918, the issue stems from insufficient authentication and authorization controls on a user-facing cluster-proxy route.
Red Hat Kubernetes SSRF Vulnerability
The vulnerable component is designed to relay traffic between external-facing endpoints and services operating within managed Kubernetes clusters.
However, an attacker who can reach the exposed route may manipulate URL path segments, causing the proxy to forward requests to arbitrary internal services.
This behavior effectively transforms the cluster proxy into an SSRF primitive. Rather than directly connecting to a protected dashboard, API, or internal workload, an attacker can instruct the vulnerable proxy service to make the request on their behalf.
Since that request originates from infrastructure trusted by the managed-cluster environment, existing network segmentation, firewall rules, and internal-only access restrictions may not adequately prevent access.
Red Hat identified multicluster-engine/cluster-proxy-addon-rhel9 and multicluster-engine/cluster-proxy-rhel9 as affected components.
At the time of disclosure, the advisory did not list security errata for either package. The vendor advised organizations to treat earlier packages in applicable minor-version streams as vulnerable unless they are explicitly identified as unaffected.
The CVSS vector for CVE-2026-66794 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. This indicates that the vulnerability is remotely exploitable over a network, requires low attack complexity, needs no privileges or user interaction, and crosses a security boundary.
Red Hat initially evaluated the vulnerability as potentially more severe. It later revised the assessment after confirming that the flaw enables unauthenticated SSRF rather than remote code execution.
As a result, Red Hat classified the issue as Important instead of Critical, despite its high CVSS score. The practical impact depends on the services reachable from affected managed clusters and the security controls applied to those services.
An attacker could potentially query internal API endpoints, enumerate services, retrieve exposed data, or interact with management dashboards that rely exclusively on network isolation.
Services that independently enforce robust authentication and authorization remain less exposed, although the proxy could still reveal useful information about internal infrastructure.
Organizations using Multicluster Engine for Kubernetes should immediately identify whether cluster-proxy-addon routes are externally reachable.
Security teams should also review ingress, load balancer, and management plane configurations; inspect routing and proxy logs for suspicious path manipulation; and validate that internal services do not rely solely on segmentation for protection.
CVE-2026-66794 highlights the risk of exposing Kubernetes management proxies. In multicluster environments, a single improperly protected proxy route can serve as a bridge to multiple internal cluster services.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
