Bug 2507539 (CVE-2026-66794) - CVE-2026-66794 cluster-proxy-addon: cluster-proxy-addon: unauthenticated SSRF to arbitrary managed-cluster services via public Route
Summary: CVE-2026-66794 cluster-proxy-addon: cluster-proxy-addon: unauthenticated SSRF...
Keywords:
Status: NEW
Alias: CVE-2026-66794
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 15:45 UTC by OSIDB Bzimport
Modified: 2026-08-19 14:21 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-27 15:45:52 UTC 
The user-facing Route uses tls.termination: reencrypt with no client-cert requirement and no oauth-proxy sidecar. The user-server ServeHTTP handler performs no authentication or authorization; it parses the URL and proxies to managed-cluster services. The target host is built from client-controlled URL path segments (Cluster-Proxy-Namespace / Service / Port headers). No allow-list is consulted; the ManagedProxyServiceResolver CRD governs only what the ANP agent may dial and is not enforced for the second hop. An unauthenticated attacker who can reach the Route can proxy requests to arbitrary services on any managed cluster, including internal services not otherwise exposed.

Source: Project Glasswing AI-SAST audit of stolostron/cluster-proxy-addon.
Finding ID: CPA-2026-002
Assurance: machine_verified
Note You need to log in before you can comment on or make changes to this bug.