CVE-2026-17107
Awaiting Analysis Awaiting Analysis - Queue

Impersonation Group Header Injection in Red Hat ACM

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Red Hat, Inc.

Description
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-17107
EUVD
EUVD-2026-48728

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
red_hat advanced_cluster_management_for_kubernetes *
red_hat multicluster_engine *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the cluster-proxy service-proxy component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy adds impersonation group headers to requests without removing any user-supplied values. Since the spoke ServiceAccount has unrestricted impersonation permissions, an authenticated hub user can inject an Impersonate-Group header to gain cluster-admin privileges on all managed clusters.

Detection Guidance

Check for unauthorized Impersonate-Group headers in proxied requests. Inspect logs for requests containing 'Impersonate-Group: system:masters' or similar values. Review service-proxy and user-server configurations for header handling. Verify spoke clusters for cluster-admin access granted to unexpected principals.

Impact Analysis

If you use RHACM or MCE, an attacker with authenticated access to the hub cluster could escalate privileges to cluster-admin on all managed clusters. This could allow unauthorized access, data theft, or disruption of services across your Kubernetes environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Unrestricted cluster-admin access may result in data breaches, unauthorized modifications, or loss of auditability, all of which are critical compliance violations.

Mitigation Strategies

Immediately revoke unrestricted impersonation permissions from spoke ServiceAccounts and update the cluster-proxy service-proxy component to remove caller-supplied impersonation group headers before forwarding requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17107. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart