Critical Red Hat Kubernetes SSRF Flaw Exposes Internal Services Across Managed Clusters

Cybersecuritynews •Abinaya • August 20, 2026

Red Hat has disclosed CVE-2026-66794, a high-severity Server-Side Request Forgery vulnerability affecting the cluster-proxy-addon component in Multicluster Engine for Kubernetes. The issue carries a CVSS v3.1 score of 9.3. It could allow unauthenticated remote attackers to reach otherwise inaccessible services running across managed Kubernetes clusters. The vulnerability exists in a user-facing route exposed by the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Red Hat Kubernetes SSRF Vulnerability Exposes Internal Services to Attackers Red Hat disclosed CVE-2026-66794, a high-severity SSRF vulnerability in the cluster-proxy-addon of the Multicluster Engine for Kubernetes. This flaw, rated with a CVSS v3.1 score of 9.3, allows unauthenticated remote attackers to access internal services across managed Kubernetes clusters via a publicly accessible route. The vulnerability affects users of Red Hat's Kubernetes offerings, potentially exposing sensitive internal services. The issue was published on August 19, 2026, and has raised significant concerns due to its potential for exploitation. Organizations using affected systems are advised to assess their security posture and apply necessary mitigations. 2 sources 69

Extracted Entities

Critical Red Hat Kubernetes SSRF Flaw Exposes Internal Services Across Managed Clusters

The full story

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)