Red Hat Multicluster Engine (HyperShift): Tenant isolation bypass via kubeconfig Secrets
Summary
The HyperShift operator copies user-provided kubeconfig Secrets into the privileged control plane namespace without validation. An authenticated user with permission to create clusters and Secrets can supply a kubeconfig containing unauthorized executable plugins. When downstream controllers consume this configuration, the attacker can execute arbitrary code within the control plane, which can lead to full compromise of confidentiality, integrity and availability. The attack requires valid credentials and tenant-level rights, not anonymous network access.
Affected
- Red Hat Multicluster Engine for Kubernetes (default: affected)
- Exact affected versions: Unknown.
Fixed in
Unknown. Check the Red Hat advisory for the fixed release.
Workaround
- No vendor-confirmed mitigation is available.
- Third-party suggestions, not vendor guidance: restrict Secret creation to trusted accounts in HyperShift-watched namespaces, deploy an admission webhook that rejects kubeconfig Secrets containing exec plugins, and audit existing kubeconfig Secrets for embedded plugins.
Exploitation
- Not known to be exploited in the wild.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Public proof of concept: Unknown.
Our recommendation
- Check whether HyperShift or Multicluster Engine is deployed. If not, no action is needed.
- If it is deployed, review who can create Secrets and clusters in HyperShift-watched namespaces and restrict these rights to trusted administrators.
- Audit existing kubeconfig Secrets for embedded exec plugins.
- Apply the Red Hat fix as soon as the fixed release is confirmed in the advisory.
- Monitor the Red Hat advisory and Bugzilla entry for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla 2542541 bugzilla.redhat.com
- Offseq CVE mirror radar.offseq.com
- Strix CVE summary www.strix.ai
- Install Guard CVE mirror hol.org
- Threatint CVE mirror cve.threatint.com
- Vulners PT-2026-106050 vulners.com
- HyperShift developer article developers.redhat.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:33.
Original description (NVD)
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit this vulnerability by supplying a configuration containing unauthorized executable plugins. When downstream controllers consume this configuration, an attacker can achieve arbitrary code execution within the control plane.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.