ReviewHigh

CVE-2026-75569

Red Hat multicluster engine for Kubernetes 2.10, multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.

CVSS: 7.7
EPSS: -
CISA KEV: Not listed
Published: 2026.08.20

PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.7

Vulnerability overview

Affected product and versions

Product: Red Hat multicluster engine for Kubernetes 2.10, multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17
Affected versions: See the vendor advisory and NVD configuration data
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Red Hat multicluster engine for Kubernetes 2.10, multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
CWE: CWE-829