Log in Start free

Vulnerability · Published Aug 19, 2026 · Assigned by redhat

CVE-2026-75569Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

High 7.7

In plain English

A high-severity security flaw in multicluster engine for Kubernetes 2.10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

Affected products (as reported)

VendorProductVersions
Red Hat multicluster engine for Kubernetes 2.10 see references
Red Hat multicluster engine for Kubernetes 2.11 see references
Red Hat multicluster engine for Kubernetes 2.17 see references
Red Hat multicluster engine for Kubernetes 2.6 see references
Red Hat multicluster engine for Kubernetes 2.8 see references
Red Hat multicluster engine for Kubernetes 2.9 see references

Weakness: CWE-1357 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

References