Red Hat multicluster engine for Kubernetes 2.10

• CVE-2026-73267 High 7.7 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check 0.6%
• CVE-2026-75569 High 7.7 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha 0.6%
• CVE-2026-66794 Critical 9.3 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route 0.6%
• CVE-2026-66795 Critical 9.9 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) 0.5%
• CVE-2026-73266 High 7.1 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join 0.4%
• CVE-2026-19130 Medium 5.8 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization 0.4%
• CVE-2026-73268 Critical 9.9 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection 0.9%
• CVE-2026-73269 Critical 9.9 Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa 0.6%
• CVE-2026-17107 High 8.5 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster 0.6%