Critical Red Hat Kubernetes SSRF Flaw Exposes Internal Services Across Managed Clusters
Red Hat has disclosed CVE-2026-66794, a high-severity Server-Side Request Forgery vulnerability affecting the cluster-proxy-addon component in Multicluster Engine for Kubernetes. The issue carries a CVSS v3.1 score of 9.3. It could allow unauthenticated remote attackers to reach otherwise inaccessible services running across managed Kubernetes clusters. The vulnerability exists in a user-facing route exposed by the \[…\] The post Critical Red Hat Kubernetes SSRF Flaw Exposes Internal Services Across Managed Clusters appeared first on Cyber Security News.
Red Hat has disclosed CVE-2026-66794, a high-severity Server-Side Request Forgery vulnerability affecting the cluster-proxy-addon component in Multicluster Engine for Kubernetes.
The issue carries a CVSS v3.1 score of 9.3. It could allow unauthenticated remote attackers to reach otherwise inaccessible services running across managed Kubernetes clusters.
The vulnerability exists in a user-facing route exposed by the cluster proxy add-on. According to Red Hat, the route does not properly enforce authentication and authorization before forwarding requests.
An attacker who can access this endpoint can manipulate URL path segments to make the proxy send requests to arbitrary services in managed clusters.
This behavior is classified as CWE-918, or SSRF. Rather than directly attacking an internal service from the internet, an attacker abuses the vulnerable proxy as an intermediary.
Red Hat Kubernetes SSRF Flaw
--------------------------------
The proxy appears to be trusted by internal infrastructure, allowing requests to cross boundaries that network controls, service exposure restrictions, or cluster segmentation would normally protect.
In a multicluster Kubernetes deployment, this could be particularly serious. Management-plane components often have connectivity to services distributed across several managed clusters.
If exposed via a vulnerable route, attackers may access internal APIs, retrieve sensitive application data, identify reachable internal endpoints, or interact with services never intended to be externally available.
For example, an attacker could manipulate a request path so that the affected proxy contacts an internal service in a managed cluster.
If that service returns configuration data, tokens, debugging details, or application responses without requiring separate authentication, the attacker may obtain information useful for further intrusion.
The actual impact depends on which services the proxy can reach and what security controls those services enforce. Red Hat rated the issue Important rather than Critical despite the high 9.3 CVSS score.
Its analysis states that the confirmed impact is unauthenticated SSRF, not remote code execution. The vendor identified high confidentiality impact, low integrity impact, and no demonstrated availability impact.
The affected components are multicluster-engine/cluster-proxy-addon-rhel9 and multicluster-engine/cluster-proxy-rhel9 within Multicluster Engine for Kubernetes.
At the time of publication, Red Hat listed both as affected and did not identify associated security errata. Organizations should immediately restrict network access to the user-facing cluster-proxy-addon route.
Red Hat recommends applying firewall rules or equivalent network controls to ensure that only trusted networks and authorized sources can connect to the exposed port.
Administrators should also review route exposure, inspect proxy access logs for unusual path patterns, and identify sensitive internal services reachable from the management environment.
*Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC*
The post Critical Red Hat Kubernetes SSRF Flaw Exposes Internal Services Across Managed Clusters appeared first on Cyber Security News.