Bug 2507540 (CVE-2026-66795) - CVE-2026-66795 managedcluster-import-controller: managedcluster-import-controller: CSR auto-approver does not validate certificate Subject, signerName, or requester identity
Summary: CVE-2026-66795 managedcluster-import-controller: managedcluster-import-contro...
Keywords:
Status: NEW
Alias: CVE-2026-66795
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-27 15:46 UTC by OSIDB Bzimport
Modified: 2026-08-17 20:31 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-27 15:46:00 UTC 
The CSR auto-approval logic checks: (1) csr.Labels[open-cluster-management.io/cluster-name] — attacker-controlled (any CSR creator sets labels); (2) csr.Spec.Username must equal system:serviceaccount:clusterName:clusterName-bootstrap-sa or system:serviceaccount:open-cluster-management-hub:grpc-server-sa; (3) existence of a ManagedCluster named clusterName. It never decodes csr.Spec.Request (the PEM-encoded x509 CSR) and never inspects csr.Spec.SignerName. The hub controller's own ClusterRole grants certificatesigningrequests/approval:update and signers:approve with no resourceNames restriction. A spoke bootstrap SA can submit a CSR requesting system:masters group membership with any signerName, get it auto-approved, and obtain hub cluster-admin credentials.

Source: Project Glasswing AI-SAST audit of stolostron/managedcluster-import-controller.
Finding ID: FIND-001
Assurance: execution_proven
Note: Live validation on running cluster did not reproduce (countersign conflict). Code-level vulnerability confirmed via static analysis.
Note You need to log in before you can comment on or make changes to this bug.