Vulnerability · Published Oct 5, 2026 · Assigned by redhat

CVE-2026-101919Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

High 8.8

In plain English

A high-severity improper input validation in Multicluster Engine for Kubernetes from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 63.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Multicluster Engine for Kubernetes	see references

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-101919 vdb-entry, x_refsource_REDHAT
RHBZ#2542541 issue-tracking, x_refsource_REDHAT