CVE-2026-17107 HIGH

CVE-2026-17107: Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster

Weakness CWE-441

Published July 24, 2026

Last update August 9, 2026

View on NVD All CVEs

CVSS base score

8.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.

Key dates

02Disclosure timeline

July 24, 2026 CVE published

August 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-17107 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/441.html AskarLabs — CWE-441 write-up Unintended Proxy or Intermediary ('Confused Deputy')