A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and knowledge of a prior credential value, could exploit an authorization bypass vulnerability. By manipulating `copiedFrom` labels, the attacker could intercept newly rotated provider credentials, leading to unauthorized information disclosure. This allows access to sensitive credentials that should otherwise be protected.

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via ClusterCurator ServiceAccount token form-data: form-data: Form field override via CRLF injection provider-credential-controller: provider-credential-controller: cross-namespace credential propagation via attacker-controlled copiedFrom labels bypasses authorization crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls net/textproto: golang: Golang net/textproto: Misleading error messages via input injection cluster-proxy-addon: cluster-proxy-addon: unauthenticated SSRF to arbitrary managed-cluster services via public Route managedcluster-import-controller: CSR auto-approver does not validate certificate Subject or signerName (spoke→hub cluster-admin) clusterclaims-controller: Confused deputy: tenant-controlled ClusterClaim labels propagated to ManagedCluster, enabling cross-tenant ManagedClusterSet join clusterclaims-controller: ManagedCluster deletion keyed solely on ClusterClaim.Spec.Namespace with no local ownership check cluster-curator-controller: cluster-curator-controller: spec.instal…