CVE-2026-19130: Provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedfrom labels bypasses authorization

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). The controller propagates rotated provider credentials to child Secrets across namespaces based on copiedFrom labels. The only authorization check is a SHA-256 hash comparison between the child Secret's data and the source Secret's prior (pre-rotation) data. An attacker with secrets:create permission in any namespace on the hub cluster can create a child Secret with matching copiedFrom labels pointing at a victim's source Secret. If the attacker knows the byte-exact prior credential value, the controller will overwrite their child Secret with the newly rotated credential on the next rotation cycle. This allows the attacker to intercept rotated provider credentials they should not have access to.

The vulnerability exists in controllers/providercredential/provider-credential-controller.go in the reconcileProviderCredentials function (lines 118-179). The controller performs a cluster-wide List of all Secrets matching copiedFrom labels (line 119-122) and uses only the hash gate (line 161) to authorize the credential push -- no namespace allowlist, ownerReference, or SubjectAccessReview is performed.

CWE-639: Authorization Bypass Through User-Controlled Key (the copiedFrom labels are the user-controlled authorization key). Also CWE-284: Improper Access Control.

Preconditions: (1) Attacker has secrets:create in any namespace on the hub. (2) Attacker possesses the byte-exact prior plaintext of the source provider Secret. (3) Hub admin performs a credential rotation on the source Secret.

Discovered via Red Hat ProdSec AI-assisted security assessment (Project Glasswing).

— Red Hat