CVE-2026-66794

CriticalCVSS 9.3/10Last modified Sep 29, 2026

Description

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Sep 29, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-667959.9A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incCVE-2026-667975.4Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation CVE-2026-667984.3Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-667997.8Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.CVE-2026-668007.5Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.CVE-2026-668028.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allowCVE-2026-6680310.0Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.CVE-2026-668047.8Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.CVE-2026-668058.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-668065.5Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-668077.8Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-668088.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-66794: Critical severity, CVSS 9.3 | Vulnix