Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-24 | 1 | Patch1 |
| 2026-07-25 | 5 | Disclosure3General1Patch1 |
| 2026-07-29 | 1 | Disclosure1 |
| 2026-09-22 | 1 | Patch1 |
Red Hat ACM / multicluster-engine の cluster-proxy の脆弱性が、CVE-2026-17107（CVSS 8.5 / High）として公開されました. 脆弱性の発見・報告から修正まで対応させて頂きました. 詳細はこちらから👇 https://access.redhat.com/security/cve/cve-2026-17107
Post summary
The tweet reports CVE‑2026‑17107 (CVSS 8.5) and confirms that a patch/fix has been issued, directing readers to the Red Hat advisory for details.
CVE-2026-17107: authenticated user on a Red Hat RHACM or MCE hub can become cluster-admin on every managed cluster by injecting one HTTP header. CVSS 8.5. Here's what to check Saturday.
Post summary
A new CVE (2026‑17107) is disclosed, where an authenticated user on Red Hat RHACM or MCE hubs can gain cluster‑admin rights via a single HTTP header injection; the flaw has a CVSS score of 8.5.
Saturday action: audit who has authenticated access to your hub cluster. Review impersonation RBAC on spoke ServiceAccounts. Watch https://access.redhat.com/security/cve/CVE-2026-17107 for the patch drop.
Post summary
The post urges teams to audit RBAC on OpenShift clusters and stay tuned for a Red Hat patch addressing CVE‑2026‑17107.
CVE-2026-17107 A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The se… https://www.cve.org/CVERecord?id=CVE-2026-17107
Post summary
The post announces the discovery of a CVE-2026-17107 flaw in Red Hat Advanced Cluster Management for Kubernetes and multicluster-engine, but provides no PoC, exploit, patch, or technical details.
CVE-2026-17107 in RHACM and MCE allows privilege escalation via Impersonate-Group header injection, with CVSS 8․5 severity. https://ift.tt/gjFCkPw
Post summary
The post announces a new privilege‑escalation vulnerability (CVE‑2026‑17107) in RHACM and MCE via header injection, noting a CVSS score of 8.5, but does not mention exploits, PoC, or patches.
Multi-cluster tooling is a force multiplier for attackers. One compromised hub credential, every workload cluster owned. Segment your control plane access like your life depends on it. https://nvd.nist.gov/vuln/detail/CVE-2026-17107
Post summary
The post merely references CVE-2026-17107 without providing additional context, evidence of exploitation, or remediation information.
🚨*CVE* CVE-2026-17107 A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The se… https://www.cve.org/CVERecord?id=CVE-2026-17107 ----- Traducción: Se encontró una fa… http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-17107) has been disclosed, identifying a flaw in the cluster‑proxy service‑proxy component of Red Hat Advanced Cluster Management for Kubernetes, with a link to the official CVE record.
🚨High - Red Hat ACM/MCE cluster-proxy Impersonation Header Injection to cluster-admin (CVE-2026-17107) The cluster-proxy service-proxy in Red Hat Advanced Cluster Management (RHACM) and multicluster-engine (MCE) appends Kubernetes impersonation group headers to proxied requests without stripping caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation rights. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster - effectively fleet-wide compromise from a single hub account. Scope-changing, full CIA impact. CVSS 8.5. 👉Apply the Red Hat update for CVE-2026-17107 and review impersonation RBAC on spoke ServiceAccounts.
Post summary
A CVE-2026-17107 vulnerability enables cluster‑wide impersonation via header injection in Red Hat ACM/MCE; users are advised to apply the vendor update and review impersonation RBAC settings.