CVE-2026-19130
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster and knowledge of a prior credential value could exploit an authorization bypass. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure.
Risk Assessment
Risk of unauthorized access to sensitive credentials, potentially leading to cluster compromise.
Recommendation
Update multicluster-engine to a version that includes the authorization bypass fix.
Original NVD description (English source)
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.