Certificate Signing Request Validation Bypass in ManagedCluster Import Controller

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: redhat-SADP

Description

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-66795

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	managedcluster-import-controller	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

This vulnerability is in the managedcluster-import-controller where the CSR auto-approval logic fails to properly validate incoming Certificate Signing Requests. It does not check the signer name or decode the PEM-encoded x509 CSR, allowing a privileged service account on a spoke cluster to submit a malicious CSR. Exploitation can lead to privilege escalation and unauthorized administrative access to the hub cluster.

Impact Analysis

If exploited, this vulnerability allows an attacker with access to a spoke cluster to gain administrative credentials on the hub cluster. This could lead to unauthorized control over the entire cluster environment, data breaches, or further lateral movement within the infrastructure.

Mitigation Strategies

Disable automatic CSR approval in the managedcluster-import-controller and manually review all incoming CSRs before approval. Restrict privileges of service accounts on spoke clusters to prevent unauthorized CSR submissions.

Hi! I’m here to help you understand CVE-2026-66795. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70