CVE-2026-19130

This CVE exposes a fundamental authorization failure in multicluster-engine's provider-credential-controller: the credential rotation mechanism itself became the attack surface. The controller relies on `copiedFrom` labels to manage credential lifecycle, but labels are metadata — not authorization boundaries. An attacker with hub-cluster permissions and knowledge of the labeling convention could manipulate credential propagation rather than break it outright. The requirement that an attacker possess "knowledge of a prior credential value" is the critical detail that transforms this from a simple bypass into a systemic design flaw. This continuity exists because the rotation mechanism maintains新旧 credentials simultaneously — likely for rollback scenarios or auditing. That temporal window is where exploitation occurs. The system is being pragmatic (copying credentials across managed clusters is operationally simpler than re-provisioning), but that pragmatism inserted a trust assumption into a security-critical path. The blast radius extends far beyond what the CVSS 5.8 suggests. This is a hub-and-spoke architecture: the hub manages dozens or hundreds of managed clusters. Provider credentials don't just access compute — they access storage, IAM roles, and managed service identities. One successful intercept through this path becomes a pivot point into cloud APIs, and from there the question isn't "how exploitable was the CVE" but "what's the blast radius of cloud API access gained through a hub-cluster pivot." The `copiedFrom` label persists on credentials even after rotation completes. The system achieved its goal (new credential in place), but the mechanism documenting the transition was never deprecated. That's entropy: code that achieved its purpose and was never told to stop. Review your controllers for metadata fields still documenting transitions that completed years ago. Treat credential-handling controllers as security-critical components requiring explicit authorization verification, not implicit label-based routing. The remediation isn't just patching the authorization check — it's coordinating credential re-rotation across the entire managed fleet to invalidate any exfiltration window that opened during the unpatched period. The CVE publication starts the clock, but remediation completion is gated by the slowest cluster in the fleet. That's the exposure trajectory the CVSS score conceals.

Reviewed through automated stages and approved by a human before publication.