RHACM/MCE Service-Proxy Group Impersonation Escalation
CVE-2026-17107 Published on July 24, 2026
Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
Vulnerability Analysis
CVE-2026-17107 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 63 days later.
Weakness Type
What is a Confused Deputy Vulnerability?
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CVE-2026-17107 has been classified to as a Confused Deputy vulnerability or weakness.
Products Associated with CVE-2026-17107
Want to know whenever a new CVE is published for Red Hat Multicluster Engine? stack.watch will email you.
