Red Hat has revealed a major vulnerability, tagged CVE-2026-66794, in its Multicluster Engine for Kubernetes. The issue impacts the cluster-proxy-addon component and enables unauthenticated attackers to exploit a Server-Side Request Forgery (SSRF) flaw with a high severity rating.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
This flaw, which earns a CVSS v3.1 score of 9.3, arises because a user-facing route exposed by the cluster proxy addon fails to enforce proper authentication and authorization. Through manipulating URL path segments, an attacker could redirect proxy requests toward arbitrary internal services in managed clusters, breaching internal boundaries normally protected by network controls.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
What’s at Risk in Multicluster Environments
In environments using Kubernetes across multiple clusters, admin components and proxies frequently bridge across the infrastructure. This discovery means that malicious actors could reach APIs and services that weren’t intended to be publicly reachable. Sensitive data exposed by this route could include configuration files, tokens, debug interfaces, or any internal endpoint that lacks separate safeguards.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
Despite the high CVSS rating, Red Hat has classified the vulnerability as “Important,” not “Critical,” because the confirmed impact is limited to SSRF without known remote code execution. The issue has high potential for confidentiality compromise, lower impact on integrity, and no verified availability effects.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
Which Systems Are Affected & What To Do
The flaw affects the components multicluster-engine/cluster-proxy-addon-rhel9 and multicluster-engine/cluster-proxy-rhel9 within Red Hat’s Multicluster Engine for Kubernetes. At the time of disclosure, there were no patches or security errata published.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
Red Hat recommends that organizations using these components take immediate mitigations. These include restricting access to the exposed cluster-proxy-addon route via firewall rules or equivalent network controls, limiting connections only to trusted networks. Administrators are also advised to audit route exposures, review proxy logs to detect abnormal path patterns, and confirm which internal services the management environment can reach.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
This SSRF issue is categorized under CWE-918. An attacker using it can act through the proxy as a conduit to reach services within the managed cluster that are otherwise shielded. Such an attack strategy undermines segmentation and network isolation—key controls in cloud native and Kubernetes deployments.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
While there is no proof yet of data exfiltration or further intrusion, the vulnerability’s reach depends heavily on the internal services connected and their own authentication and exposure settings.([cybersecuritynews.com](https://cybersecuritynews.com/red-hat-kubernetes-ssrf-flaw/))
The takeaway: any user-facing route without proper access controls in a multicluster setup can become a major breach vector. For Red Hat’s users, the SSRF risk here warrants swift action—and may serve as a warning for all Kubernetes operators to scrutinize exposed proxy mechanisms.
