RHSA-2026:48284CriticalCVSS 9.4

Red Hat Security Advisory: multicluster engine for Kubernetes v2.17.1 security update

Published
July 29, 2026
Last Modified
August 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-17107 →CVE-2026-16242 →

📋 Description

CVE-2026-16242 — hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates CVE-2026-17107 — cluster-proxy: cluster-proxy: Impersonation header injection in service-proxy grants cluster-admin on every managed cluster

🎯 Affected products141

  • multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:4b003a8184a2e34077a742b986f571e5ca96d66ef535fe5a9d43d2ac18f925b7_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:57729335e2ce5c5def1e79932666699140a2df9d0dd1bb6904b20e64ef943b4b_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:a550677f600cf40efc58871c6c5ac28570fabca484e0306f087f84df239a1ee0_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:e845ccb27e478ffb2f9d8ec671e162c96b9224df85ec6572d913d5ad7321f6ff_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:3bfc8c89d7d51c648eb77a7bff2362fbc9ee6310c43ffd931fe01735bc3f103d_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:5eecf329f0d6ba5c16bc6a5e2005176569863b80c27ce15e5ad353522fbc3d8c_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:b45512d4d2e66ea744ed2ee186f038142a6ef396ce96f9adde4ab4213dab1159_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:c15347006f2a62b47018bd1a2c8163268ee5334b51917b612f2a2611fded4318_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:1c31a0757eec166fb86ff1ca0f24fb727b278c0583f15f75057a9d96c08d493c_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:4e9a64207df408e82515c313f42abe1fe02b427934dcf5eff11b277f533b310a_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:8aea21bc9612033a64aef73ed28faae689ef5e8e4293f2cd15452b4be06776b0_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:9e97566ca9ae4fdc6ba952423c1f6915062be775b4e55fc0a4b3f6ac91081310_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:ab798af3c0396f1885f85994c456aff0f7773a2ddedcd167c39d08e8202532a6_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:d5cbc80ef51a99c92817b5ebe8e8b976d2dc3893bf2e463a612e186ffe162fba_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:e3b9bf7b8fba896424ee863fe1194afa6dcc5c6014a490b1c4eac8ad4981c533_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-bootstrap-rhel9@sha256:ec251a67dac8f03dd43882db3ff86b48687f532e27a62802d047fe2bc5c7ce61_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:0e8366b711055b8341b8f8bc68b4d2526884878430580b53489461a50e6e1e02_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:889fed1d00b852cf889c9426bf7dd47f555c83bf3560d858ea49801d0bae03c3_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:912346604d5cfe4385db085dcf1970ca322712a087d10dd3afc5f7631e2ec232_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/capoa-control-plane-rhel9@sha256:e5c89f153fa6951ac5dcd8712e0a374d71b9a950b249cf9513312f48140d0a6f_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:2206fc7de2213bc8c016be0b3a27bd0cb754957bcf6887ed33b24d125e8c943d_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:341646f30da49d74d28647027139af632fd18f7ac812de20ee63cc2f2ec7b90c_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:3dab4bc2140b49aa09196eed109c7d0b219c66a32ffdf7f8aaccd74cbb6102fb_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cloudevents-conductor-rhel9@sha256:6e3258d1de418f5d7219ef5e6db54af70e9c79f216c7b99d821b21bb8fdc46cc_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:5e21d951965ea7c3e9ebee0bfd8a0bd348d89a8c790c077837ba09ce9f492aa3_amd64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:82dac2c0cf74424db2c2dbd09e03dd0eaa126c57069aee32b918adaa9c484b81_ppc64le as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:bcdd359682da3a4dcc98b80c3b3009c0742726ebe58fa017ca8d8a599e7f046b_arm64 as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:e21c98b532ec449c705da4eb2923630f4375e5636b85591f2b9a3836c590102f_s390x as a component of multicluster engine for Kubernetes 2.17
  • registry.redhat.io/multicluster-engine/cluster-api-provider-aws-rhel9@sha256:107f9b215627c43a883848c935d2da0b1982c004737cb0b691ae3cf41e0da4b5_s390x as a component of multicluster engine for Kubernetes 2.17
  • +111 more not shown

✅ Remediation

For multicluster engine for Kubernetes, see the following documentation for details on how to install the images: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.17/html/clusters/cluster_mce_overview#mce-install-intro Workaround: Until an update that configures Konnectivity agent authentication is applied, restrict network access to the Konnectivity cluster (agent) endpoint so that only trusted worker networks can reach it. For NodePort or LoadBalancer publishing, limit ingress to port 8091 to worker node subnet ranges. For Route-based publishing, restrict access to the Konnectivity route to trusted networks where possible. These controls reduce the chance that an unauthenticated attacker can reach the agent listener; they do not replace proper agent client-certificate (or token) authentication. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (5)