Remote Code Execution Vulnerability in mce-operator-bundle from Red Hat
CVE-2026-75569

7.7HIGH

Key Information:

Vendor

Red Hat
Status
Multicluster Engine For Kubernetes
Vendor
CVE Published:
19 August 2026

What is CVE-2026-75569?

A security flaw exists in the mce-operator-bundle where the build process improperly fetches and executes scripts from a remote repository without conducting necessary integrity checks like commit pinning or signature verification. This vulnerability allows an attacker with write access to the remote repository to execute arbitrary code during the build process, compromising the integrity of the software and potentially leading to the distribution of malicious code.

References

https://access.redhat.com/security/cve/CVE-2026-75569
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2519849
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.