Junglewise Threat Intelligence

CVE-2026-7163: Red Hat Multicluster Engine information disclosure in assisted-service API

CVE-2026-7163 · Severity: medium · CVSS 6.1 · Published 2026-04-30

Vendors: Red Hat.

Executive brief

A vulnerability in the Red Hat Multicluster Engine (MCE) allows users with very limited access to steal administrative credentials for any cluster managed by the system. This component is used to deploy and manage multiple OpenShift clusters across different cloud environments. An attacker could use this access to gain full control over connected clusters, potentially leading to data theft or service disruption.

Technical details

The vulnerability exists in the assisted-service REST API component of Red Hat Multicluster Engine (MCE) and Advanced Cluster Management (ACM). In on-premises deployments using 'local' authentication mode, the system unconditionally grants full administrative access to any request containing a valid JSON Web Token (JWT) without per-endpoint restrictions. A valid JWT is exposed as a plaintext query parameter within the 'InfraEnvStatus.ISODownloadURL' field, which is accessible to any user with 'get' permissions on an 'InfraEnv' object in their own namespace. An attacker can use this token to access the credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials) to retrieve the 'kubeadmin' password and kubeconfig for any cluster managed by the hub. This issue does not affect the hosted SaaS offering.

Affected products

  • Red Hat Multicluster Engine for Kubernetes (MCE) 2.1, 2.7, 2.10
  • Red Hat Advanced Cluster Management for Kubernetes (ACM)

Timeline

  • 2026-04-29: patched: Initial security advisories RHSA-2026:11511 and RHSA-2026:11512 issued.
  • 2026-04-30: disclosed
  • 2026-04-30: advisory: NVD and Red Hat CVE records published.

References