{"schema_version":"1","data":[{"id":3975,"advisory_id":"277ca367-9757-4967-be43-917967d39b0a","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-19130","source_published_at":"2026-08-12T20:46:21.305+00:00","published_at":"2026-10-24T21:44:32.181909+00:00","extraction_method":"structured","technologies":["core-cve","multicluster-engine-for-kubernetes-2-10","multicluster-engine-for-kubernetes-2-11","multicluster-engine-for-kubernetes-2-17","multicluster-engine-for-kubernetes-2-6","multicluster-engine-for-kubernetes-2-8","multicluster-engine-for-kubernetes-2-9"],"cve_ids":["CVE-2026-19130"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization","summary":"A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.","evidence":"cve:CVE-2026-19130","products":[{"name":{"value":"multicluster engine for Kubernetes 2.10","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"multicluster engine for Kubernetes 2.11","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"multicluster engine for Kubernetes 2.17","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"multicluster engine for Kubernetes 2.6","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"multicluster engine for Kubernetes 2.8","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"multicluster engine for Kubernetes 2.9","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-19130","aliases":["CVE-2026-19130"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:multicluster_engine:2.10::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.10","versions":[{"status":"unaffected","version":"1787176886","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine:2.11::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.11","versions":[{"status":"unaffected","version":"1787239595","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine:2.17::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.17","versions":[{"status":"unaffected","version":"1786664288","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine:2.6::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.6","versions":[{"status":"unaffected","version":"1787260821","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine:2.8::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.8","versions":[{"status":"unaffected","version":"1787259099","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:multicluster_engine:2.9::el9"],"vendor":"Red Hat","product":"multicluster engine for Kubernetes 2.9","versions":[{"status":"unaffected","version":"1787176716","lessThan":"*","versionType":"rpm"}],"packageName":"multicluster-engine/provider-credential-controller-rhel9","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"}],"modified":"2026-09-29T19:41:06.721Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/security/cve/CVE-2026-19130","https://bugzilla.redhat.com/show_bug.cgi?id=2512105"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19130","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-14T22:13:54.758866Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-14T22:14:05.851Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-09-29T19:41:06.721Z"}}},"related_cves":[{"value":"CVE-2026-19130","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":3975,"next_before":3975}