Red Hat multicluster engine for Kubernetes 2.9

• CVE-2026-73267 High 7.7 Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check 0.6%
• CVE-2026-75569 High 7.7 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha 0.6%
• CVE-2026-66794 Critical 9.3 Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route 0.6%
• CVE-2026-66795 Critical 9.9 Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin) 0.5%
• CVE-2026-73266 High 7.1 Clusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join 0.4%
• CVE-2026-19130 Medium 5.8 Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization 0.4%
• CVE-2026-73268 Critical 9.9 Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows arbitrary job spec injection 0.9%
• CVE-2026-73269 Critical 9.9 Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creates clusterrolebinding granting cluster-wide secrets access to namespace-local sa 0.6%
• CVE-2026-10059 Critical 9.1 Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount token 0.6%
• CVE-2026-17107 High 8.5 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster 0.6%
• CVE-2026-16242 Critical 9.4 Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates 0.9%
• CVE-2026-7163 Medium 6.1 Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure 0.2%
• CVE-2026-4740 High 8.2 Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation 0.2%
• CVE-2025-7195 Medium 6.4 Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd 0.2%