CVE-2026-66795 in Multicluster Engine for Kubernetes
Summary
by MITRE • 08/17/2026
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The managedcluster-import-controller within OpenShift and Kubernetes-based distributed infrastructure serves as a critical component for establishing secure communication channels between central management hubs and remote spoke clusters. This controller is responsible for handling certificate signing requests generated by agents running on these edge nodes to authenticate them against the control plane. The identified vulnerability resides in the logic that automates the approval of these Certificate Signing Requests, which is designed to streamline cluster joining processes without manual intervention. However, this automation contains a significant security flaw where the validation mechanism fails to enforce strict checks on two fundamental aspects of the incoming request: it does not inspect the signer name field and neglects to properly decode or validate the structure of the PEM-encoded x509 Certificate Signing Request before processing it for approval.
From a technical perspective, this oversight creates an avenue for certificate forgery and identity spoofing. In standard PKI operations within Kubernetes environments, the signer name is crucial because it determines which specific CA (Certificate Authority) will sign the certificate and what permissions are subsequently granted to the holder of that certificate. By failing to verify the intended signer, the controller allows a requester to potentially manipulate or bypass expected authorization boundaries. Furthermore, the lack of proper decoding and validation of the PEM-encoded x509 CSR means that malformed or maliciously crafted data structures can be processed without triggering standard integrity checks. This deficiency effectively neutralizes several layers of defense that rely on strict schema compliance and attribute verification during the certificate issuance phase.
The operational impact of this vulnerability is severe, primarily due to the privilege level required for exploitation. The flaw allows a service account with privileged access on a spoke cluster to submit a malicious CSR. Once such a request is processed by the vulnerable controller logic, it can result in the generation of certificates that are trusted by the hub cluster. This leads directly to privilege escalation from a potentially lower-privileged or isolated edge node environment into the central management plane. An attacker who successfully exploits this flaw can obtain administrative credentials on the hub cluster, effectively gaining full control over the entire distributed infrastructure. This compromises not only the integrity of the spoke clusters but also exposes sensitive data and configurations managed by the central authority to unauthorized access and potential manipulation.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves a failure in restricting access to resources based on identity or role verification during the certificate issuance process. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, specifically within the context of cloud infrastructure where legitimate service accounts are abused to gain higher-level permissions. The exploitation path resembles lateral movement and privilege escalation patterns often seen in complex multi-tenant environments where trust boundaries between nodes are not rigorously enforced at every step of authentication workflows.
To mitigate this risk, immediate action is required to patch the managedcluster-import-controller to include rigorous validation logic for both the signer name attribute and the structural integrity of incoming PEM-encoded x509 CSRs. Security teams should ensure that all spoke clusters running affected versions are updated promptly. Additionally, organizations should review their RBAC policies to limit the privileges of service accounts on spoke clusters wherever possible, adhering to the principle of least privilege. Monitoring for unusual certificate signing requests or anomalies in authentication logs can help detect potential exploitation attempts before full compromise occurs. Regular audits of PKI configurations and automated testing of CSR validation logic are recommended to prevent similar oversights in future updates.