CVE-2026-66795: Cluster Import Controller Privilege Escalation

CVE-2026-66795 Overview

CVE-2026-66795 is a certificate validation flaw in the managedcluster-import-controller component. The controller's Certificate Signing Request (CSR) auto-approval logic fails to inspect the signer name or decode the PEM-encoded x509 CSR before approval. A privileged service account operating on a spoke cluster can submit a crafted CSR and receive signed credentials. Successful exploitation grants administrative access on the hub cluster, breaking the trust boundary between managed clusters and the central control plane. The vulnerability is tracked under [CWE-295: Improper Certificate Validation].

Critical Impact
A privileged spoke-cluster service account can escalate to hub cluster administrator by abusing improperly validated CSR auto-approval.

Affected Products

Red Hat managedcluster-import-controller
Red Hat Advanced Cluster Management for Kubernetes (per Red Hat advisory)
Multicluster hub deployments relying on CSR auto-approval logic

Discovery Timeline

2026-08-17 - CVE-2026-66795 published to the National Vulnerability Database
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-66795

Vulnerability Analysis

The managedcluster-import-controller automatically approves CSRs submitted during the managed cluster import workflow. The auto-approval logic performs surface-level checks but does not decode the PEM-encoded x509 CSR to inspect its contents. It also fails to validate the signerName field against an allow-list. As a result, the controller signs requests that reference privileged signers or embed identities the requester should not hold. An attacker who already controls a privileged service account on a spoke cluster can craft a CSR that impersonates a hub cluster administrator group such as system:masters. Once auto-approved, the resulting certificate authenticates directly against the hub cluster API, breaking the isolation model between spoke and hub.

Root Cause

The controller trusts CSRs based on request metadata rather than the cryptographic contents of the request. Because the PEM block is never decoded, the controller cannot enforce constraints on the embedded CommonName, Organization, or requested signerName. This aligns with CWE-295: Improper Certificate Validation.

Attack Vector

Exploitation requires network reachability to the hub cluster API and high privileges on a spoke cluster (a compromised or malicious service account with CSR submission rights). The attacker submits a CSR that requests a signer intended only for hub components and embeds group claims granting cluster-admin. The auto-approver signs the CSR, and the attacker uses the returned certificate to authenticate to the hub with elevated rights. The scope change from spoke to hub is what elevates the impact.

No verified proof-of-concept code is available. See the
[Red Hat CVE-2026-66795 Advisory](https://access.redhat.com/security/cve/CVE-2026-66795)
and [Red Hat Bug Report #2507540](https://bugzilla.redhat.com/show_bug.cgi?id=2507540)
for technical details.

Detection Methods for CVE-2026-66795

Indicators of Compromise

CSR objects on the hub cluster whose spec.signerName differs from the expected managed-cluster signer used during import.
Approved CSRs whose decoded x509 payload contains privileged groups such as system:masters or system:cluster-admins.
Kubernetes audit events showing certificate-authenticated API calls from identities that were never created through normal RBAC provisioning.

Detection Strategies

Audit CertificateSigningRequest resources on the hub for entries approved by the managedcluster-import-controller service account and reconcile them against known managed cluster onboarding events.
Decode approved CSRs and alert on any signerName outside the expected import signer, or any embedded subject requesting cluster-admin groups.
Correlate spoke cluster service account activity with new certificate issuance on the hub to identify anomalous CSR submissions.

Monitoring Recommendations

Ship Kubernetes API server audit logs and controller logs to a centralized analytics platform for retention and correlation.
Baseline the expected volume and source of import-related CSRs, and alert on deviations such as CSRs referencing unexpected signers.
Monitor hub cluster authentication events for certificate-based logins that do not map to a documented cluster or service identity.

How to Mitigate CVE-2026-66795

Immediate Actions Required

Apply the fixed version of managedcluster-import-controller as referenced in the Red Hat CVE-2026-66795 Advisory.
Review all recently approved CSRs on the hub cluster and revoke any certificates whose decoded contents request unexpected signers or privileged groups.
Rotate credentials and certificates for spoke clusters suspected of compromise, and audit RBAC bindings tied to any certificate-authenticated identities on the hub.

Patch Information

Red Hat has published tracking and remediation guidance under Red Hat CVE-2026-66795 Advisory and Red Hat Bug Report #2507540. Upgrade to the patched controller release that adds signerName validation and PEM-decoded CSR inspection to the auto-approval logic.

Workarounds

Disable CSR auto-approval on the hub cluster until the patched controller is deployed, and approve import CSRs manually after inspecting the decoded x509 contents.
Restrict which spoke cluster service accounts hold certificatesigningrequests/create rights through least-privilege RBAC.
Enforce admission policies (for example, ValidatingAdmissionPolicy or OPA/Gatekeeper) that reject CSRs whose signerName is not on an explicit allow-list.

bash

# Inspect a pending CSR before manual approval
kubectl get csr <csr-name> -o jsonpath='{.spec.request}' | base64 -d | openssl req -noout -text

# List CSRs referencing unexpected signers on the hub
kubectl get csr -o json | jq '.items[] | select(.spec.signerName | test("kubernetes.io/kube-apiserver-client$")) | .metadata.name'