CVE-2026-19130

Name of the Vulnerable Software and Affected Versions multicluster-engine (affected versions not specified)

Description An authorization bypass exists in the provider-credential-controller component. An attacker with specific permissions on the hub cluster and knowledge of a previous credential value can manipulate copiedFrom labels to intercept newly rotated provider credentials. This leads to unauthorized information disclosure of sensitive credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.