multicluster-engine/hypershift-rhel9-operator vulnerabilities
CVEs whose affected-version data names the multicluster-engine/hypershift-rhel9-operator package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-101919High· 8.8A flaw was found in the HyperShift operator
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated…
▾ TwilightRed Hat · multicluster-engine/hypershift-rhel9-operatorEPSS 0.42%via NVD
CVE-2026-16242Critical· 9.4A flaw was found in the Konnectivity proxy-server configuration for hosted control planes
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not va…
▾ MidnightRed Hat · multicluster-engine/hypershift-rhel9-operatorEPSS 0.92%via NVD