CVE-2026-66795: Managedcluster-import-controller: managedcluster-import-controller: csr auto-approver does not validate certificate subject, signername, or requester identity
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enabling the attacker to obtain administrative credentials on the hub cluster.
Other sources
The CSR auto-approval logic checks: (1) csr.Labels[open-cluster-management.io/cluster-name] — attacker-controlled (any CSR creator sets labels); (2) csr.Spec.Username must equal system:serviceaccount:clusterName:clusterName-bootstrap-sa or system:serviceaccount:open-cluster-management-hub:grpc-server-sa; (3) existence of a ManagedCluster named clusterName. It never decodes csr.Spec.Request (the PEM-encoded x509 CSR) and never inspects csr.Spec.SignerName. The hub controller's own ClusterRole grants certificatesigningrequests/approval:update and signers:approve with no resourceNames restriction. A spoke bootstrap SA can submit a CSR requesting system:masters group membership with any signerName, get it auto-approved, and obtain hub cluster-admin credentials.
Source: Project Glasswing AI-SAST audit of stolostron/managedcluster-import-controller. Finding ID: FIND-001 Assurance: executionproven Note: Live validation on running cluster did not reproduce (countersign conflict). Code-level vulnerability confirmed via static analysis.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66795?
CVE-2026-66795 has a critical severity score of 9.1.
What are the potential risks associated with CVE-2026-66795?
CVE-2026-66795 allows a privileged service account on a compromised system to issue malicious certificate signing requests.
How do I fix CVE-2026-66795?
To fix CVE-2026-66795, ensure proper validation of certificate subject, signer name, and requester identity in the CSR approval logic.
Who is affected by CVE-2026-66795?
CVE-2026-66795 affects systems utilizing the managedcluster-import-controller that incorrectly processes Certificate Signing Requests.
What is the nature of the flaw described in CVE-2026-66795?
The flaw in CVE-2026-66795 is related to improper validation in the CSR auto-approval process, specifically missing checks for signer name and requester identity.