Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-3vwx-g7ch-f3wg

Опубликовано: 12 авг. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 5.8

Описание

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating copiedFrom labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

EPSS

Процентиль: 8%
0.00179
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-639

Связанные уязвимости

CVSS3: 5.8
redhat
4 дня назад

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

CVSS3: 5.8
nvd
4 дня назад

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

CVSS3: 5.8
debian
4 дня назад

A flaw was found in the provider-credential-controller component of mu ...

EPSS

Процентиль: 8%
0.00179
Низкий

5.8 Medium

CVSS3

Дефекты

CWE-639