CVE-2026-19130

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Aug 12, 2026
Source updated: Sep 29, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

multicluster engine for Kubernetes 2.10

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.10
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.10 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787176886	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.11

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.11
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.11 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787239595	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.17

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.17
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.17 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1786664288	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.6

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.6
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.6 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787260821	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.8

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.8
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787259099	`unaffected`	rpm	*	Unavailable	None listed

multicluster engine for Kubernetes 2.9

Vendor: Red Hat
Product: multicluster engine for Kubernetes 2.9
Platforms: Unknown
Default status: affected
Package: multicluster-engine/provider-credential-controller-rhel9
Package collection: https://catalog.redhat.com/software/containers/

multicluster engine for Kubernetes 2.9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
1787176716	`unaffected`	rpm	*	Unavailable	None listed