CVE-2026-66795

Name of the Vulnerable Software and Affected Versions managedcluster-import-controller (affected versions not specified)

Description The managedcluster-import-controller contains a flaw in its Certificate Signing Request (CSR) auto-approval logic. The system fails to properly validate incoming CSRs because it does not inspect the signer name or decode the PEM-encoded x509 CSR. This allows a privileged service account on a spoke cluster to submit a malicious CSR, which can lead to privilege escalation and allow the attacker to obtain administrative credentials on the hub cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.