CVE-2026-66794

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes (affected versions not specified)

Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster, enabling unauthorized access to protected internal services and potentially leading to information disclosure or cluster compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.