Reported by 2 outlets
Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from gbhackers.com
Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services
gbhackers.com · 54d ago · August 20th, 2026
Red Hat has disclosed CVE-2026-66794, an important-severity server-side request forgery (SSRF) vulnerability in the cluster-proxy-addon component of the Multicluster Engine for Kubernetes. This flaw has a CVSS v3.1 score of 9.3. It could allow an unauthenticated remote attacker to use a publicly accessible route to access otherwise isolated services across managed clusters. Published on August […] The post Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Red Hat Kubernetes SSRF Vulnerability Exposes Internal Managed Cluster Services
cyberpress.org · 54d ago · August 20th, 2026
Tracked under CWE-918, the issue stems from insufficient authentication and authorization controls on a user-facing cluster-proxy route. Red Hat Kubernetes SSRF Vulnerability The vulnerable component is designed to relay traffic between external-facing endpoints and services operating within managed Kubernetes clusters. However, an attacker who can reach the exposed route may manipulate URL path segments, causing the proxy to forward requests to arbitrary internal services. This behavior effectively transforms the cluster proxy into an SSRF primitive. Rather than directly connecting to a protected dashboard, API, or internal workload, an attacker can instruct the vulnerable proxy service to make the request on their behalf. Since that request originates from infrastructure trusted by the managed-cluster environment, existing network segmentation, firewall rules , and internal-only access restrictions may not adequately prevent access. Red Hat identified multicluster-engine/cluster-proxy-addon-rhel9 and multicluster-engine/cluster-proxy-rhel9 as affected components. At the time of discl