THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-66795 (CRITICAL 9.9) — A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged serv

[NVD] CVE-2026-66795 (CRITICAL 9.9) — A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged serv

mednvdPublished 2026-08-17

CVE-2026-66795 CVSS: 9.9 CRITICAL Published: 2026-08-17T21:16:47.163

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicio

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-66795cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-66795