Arbitrary Code Execution Vulnerability in HyperShift Operator by Red Hat
CVE-2026-101919

8.8HIGH

Key Information:

Vendor

Red Hat
Status
Multicluster Engine For Kubernetes
Vendor
CVE Published:
5 October 2026

What is CVE-2026-101919?

A security vulnerability exists in the HyperShift operator, which improperly handles user-supplied Kubernetes configuration (kubeconfig) secrets. This flaw allows authenticated users with appropriate permissions to inject unauthorized executable plugins directly into the privileged control plane namespace without sufficient validation or sanitization. When downstream controllers process these configurations, it opens the door for attackers to execute arbitrary code within the control plane, potentially compromising the entire Kubernetes environment.

References

https://access.redhat.com/security/cve/CVE-2026-101919
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2542541
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.