CVE-2026-19130

Received Received - Intake

Authorization Bypass in Multicluster Engine Provider Credentials

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: Red Hat, Inc.

Description

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-19130

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	multicluster_engine	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass flaw in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster and knowledge of a prior credential value can manipulate copiedFrom labels to intercept newly rotated provider credentials. This leads to unauthorized access to sensitive credentials that should be protected.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain access to sensitive credentials, potentially leading to unauthorized information disclosure or further attacks within the affected system. The impact depends on the permissions and data accessible via the intercepted credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements such as GDPR or HIPAA. Unauthorized credential access could result in data breaches, triggering legal and regulatory penalties for non-compliance with data protection standards.

Mitigation Strategies

Review and restrict permissions on the hub cluster to prevent unauthorized access. Monitor for unusual credential rotation activities and ensure copiedFrom labels are not manipulated. Apply patches or updates from the vendor as soon as they become available.

Hi! I’m here to help you understand CVE-2026-19130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70