Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

AEGLIX vulnerability intelligence

CVE-2026-7163

MEDIUM · CVSS 6.1 · Modified

Published: 2026-04-30 · Updated: 2026-10-26 · Source: NVD

Stored catalog record

Source record retrieved 2026-10-28T10:19:50.543250+00:00. Scheduled imports handle updates; this page does not assert that the provider was queried just now.

Vulnerability overview

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.

Patch review priority

Assess exposure and vendor guidance

  • No higher-priority signal is available in the current stored evidence.

FIRST EPSS: 0.19% · percentile 9.0 · score date 2026-10-27.

EPSS estimates probability of exploitation in the next 30 days. It does not measure your exposure or prove exploitation. The elevated threshold is 10%; CISA KEV takes precedence. About FIRST EPSS ↗

Severity and scoring

CVSS score
6.1 · MEDIUM
CVSS version
3.1
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-312

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Not listed in the CISA catalog retrieved for this record. This does not establish that exploitation has not occurred.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

  • cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:2.1:*:*:*:*:*:*:*

  • cpe:2.3:a:redhat:multicluster_engine_for_kubernetes:2.7:*:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence