multicluster engine for Kubernetes 2.10 vulnerabilities

Product

multicluster engine for Kubernetes 2.10

by Red Hat · last CVE Aug 21, 2026

CVEs

On KEV

9.9

Max CVSS

New 30D

Severity mix

Critical 4High 4Medium 1Low 0

Severity

Exploitation

Watch

Add multicluster engine for Kubernetes 2.10 to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-17107	8.5	1%	Jul 24	Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster Affected: All versions, or not specified
CVE-2026-73267	7.7	1%	Aug 21	Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check Affected: All versions, or not specified
CVE-2026-75569	7.7	1%	Aug 19	Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha Affected: All versions, or not specified
CVE-2026-73266	7.1	0%	Aug 13	Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join Affected: All versions, or not specified