Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services

Gbhackers •Divya • August 20, 2026

Red Hat has disclosed CVE-2026-66794, an important-severity server-side request forgery (SSRF) vulnerability in the cluster-proxy-addon component of the Multicluster Engine for Kubernetes. This flaw has a CVSS v3.1 score of 9.3. It could allow an unauthenticated remote attacker to use a publicly accessible route to access otherwise isolated services across managed clusters. Published on August […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Red Hat Kubernetes SSRF Vulnerability Exposes Internal Services to Attackers Red Hat disclosed CVE-2026-66794, a high-severity SSRF vulnerability in the cluster-proxy-addon of the Multicluster Engine for Kubernetes. This flaw, rated with a CVSS v3.1 score of 9.3, allows unauthenticated remote attackers to access internal services across managed Kubernetes clusters via a publicly accessible route. The vulnerability affects users of Red Hat's Kubernetes offerings, potentially exposing sensitive internal services. The issue was published on August 19, 2026, and has raised significant concerns due to its potential for exploitation. Organizations using affected systems are advised to assess their security posture and apply necessary mitigations. 2 sources 69

Extracted Entities

Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)