CVE-2026-7163

A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub. The credentials download endpoint (GET /v2/clusters/{cluster_id}/credentials, which returns the kubeadmin password) and the kubeconfig download endpoint are operational in AUTH_TYPE=local mode, the only authentication mode available in on-premises ACM/MCE hub deployments. The local authenticator unconditionally grants full administrative access to any request bearing a valid JWT, with no per-endpoint restrictions. A valid local JWT is embedded as a plaintext query parameter in InfraEnvStatus.ISODownloadURL and is readable by any user who has get rights on an InfraEnv object in their own namespace. The affected components ship as part of Multicluster Engine (MCE). The Red Hat Advanced Cluster Management (ACM) deployments that include MCE are equally affected. This issue does not affect the hosted SaaS offering (console.redhat.com), which uses a different authentication mode. Successful exploitation gives the attacker the kubeadmin password and kubeconfig for any OpenShift cluster provisioned through the affected hub, granting unrestricted root-level administrative access to those spoke clusters.

• CWE-312
• CWE-312

• https://access.redhat.com/errata/RHSA-2026:11511Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:11512Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:12116Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:12337Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:18584
• https://access.redhat.com/errata/RHSA-2026:18585
• https://access.redhat.com/security/cve/CVE-2026-7163Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2463152Issue Tracking
• https://access.redhat.com/errata/RHSA-2026:11511Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:11512Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:12116Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:12337Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:18584
• https://access.redhat.com/errata/RHSA-2026:18585
• https://access.redhat.com/security/cve/CVE-2026-7163Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2463152Issue Tracking
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7163.json

Published

Apr 30, 2026

Last Modified

Aug 11, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71577A flaw was found in multicluster-global-hub. During a Manage…6.3
• CVE-2026-7158A vulnerability has been found in dmitryglhf mcp-url-downloa…7.3
• CVE-2026-7159A vulnerability was found in douinc mkdocs-mcp-plugin up to …7.3
• CVE-2026-7160A vulnerability was determined in Tenda HG3 2.0. This vulner…8.8
• CVE-2026-7161An insufficient encryption vulnerability exists in the Devic…9.3
• CVE-2026-7162Successful exploitation of the integer overflow vulnerabilit…7.8
• CVE-2026-7164Incorrect packet validation allowed unbounded recursion pars…7.5
• CVE-2026-7165The vulnerability is present in the ‘/addJugador’ endpoint: …9.4
• CVE-2026-7166Vulnerability involving the exposure of sensitive data provi…9.2
• CVE-2026-7167The vulnerability arises when the system fails to properly v…6.9
• CVE-2026-7168Successfully using libcurl to do a transfer over a specific …5.3
• CVE-2026-7177A security flaw has been discovered in ChatGPTNextWeb NextCh…7.3