Description

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-19T18:17:16.547Z",
  "pubdate": "2026-08-19T18:17:16.547Z",
  "executiveSummary": "A critical authentication bypass vulnerability has been identified within the cluster-proxy-addon component of Multicluster Engine for Kubernetes. This security flaw enables unauthenticated remote attackers with access to the user-facing route to completely bypass existing authentication and authorization mechanisms. By leveraging this vulnerability, an unauthorized actor can successfully proxy HTTP requests to arbitrary internal services deployed across any managed Kubernetes cluster within the environment. The primary impact includes severe information disclosure and potential lateral movement, allowing attackers to interact with protected internal cluster endpoints that should otherwise be restricted. The risk implications are substantial, as a successful compromise undermines the multi-tenant and cross-cluster security boundaries enforced by the Multicluster Engine. Exploitation requires network reachability to the user-facing route associated with the affected component, but does not necessitate prior authentication credentials, valid user sessions, or elevated privileges within the targeted managed clusters.",
  "technicalDetails": "The vulnerability resides in the request handling and URL routing logic of the cluster-proxy-addon component within Multicluster Engine for Kubernetes. Specifically, the root cause stems from improper validation and parsing of URL path segments during the proxying process. When incoming requests hit the user-facing route, the vulnerable component fails to adequately sanitize or verify the hierarchical structure of the request URI prior to evaluating access control policies. This flaw allows an attacker to craft specialized URL path segments that trick the routing engine into skipping authentication and authorization checks entirely.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies the public-facing HTTP route exposes the cluster-proxy-addon service. Second, the attacker constructs a specially crafted request containing manipulated URL path segments designed to confuse the proxy's path normalization and security enforcement routines. Third, upon receiving the malformed request, the vulnerable component misinterprets the target destination and bypasses security middleware responsible for validating user identity and permissions. Fourth, the cluster-proxy-addon forwards the proxied request to the specified internal service residing on a managed cluster.\nNetwork exposure is external, requiring reachability to the user-facing ingress or route of the Multicluster Engine. Authentication requirements are entirely absent for the exploitation vector, as the flaw allows requests to proceed without a valid security context. Privilege requirements are similarly non-existent for the initial attacker, though the resulting post-exploitation impact grants the attacker the implicit privileges of the proxy service when interacting with internal cluster endpoints. Payload behavior involves arbitrary HTTP request forwarding across cluster boundaries. The post-exploitation impact includes unauthorized access to sensitive internal microservices, APIs, and administrative endpoints across any managed cluster, potentially leading to widespread information disclosure, sensitive data exfiltration, or further compromise of the underlying Kubernetes cluster environments."
}