ME
Product
multicluster engine for Kubernetes 2.17
16
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 7Medium 3Low 0
Watch
Add multicluster engine for Kubernetes 2.17 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-17107 | 8.5 | Jul 24 | Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster Affected: All versions, or not specified |
| CVE-2026-73267 | 7.7 | Aug 21 | Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check Affected: All versions, or not specified |
| CVE-2026-75569 | 7.7 | Aug 19 | Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha Affected: All versions, or not specified |
| CVE-2026-13676 | 7.5 | Jun 29 | fast-uri vulnerable to host confusion via failed IDN canonicalization Affected: All versions, or not specified |
| CVE-2026-39829 | 7.5 | May 22 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh Affected: All versions, or not specified |
| CVE-2026-32280 | 7.5 | Apr 8 | Unexpected work during chain building in crypto/x509 Affected: All versions, or not specified |
| CVE-2026-73266 | 7.1 | Aug 13 | Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join Affected: All versions, or not specified |
Showing 7