Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-66795, stems from the managedcluster-import-controller improperly validating Certificate Signing Requests (CSRs). The core issue was the absence of checks for the signerName and the content of the PEM-encoded x509 CSR's subject. This allowed a privileged service account on a spoke cluster to submit a malicious CSR, leading to privilege escalation and obtaining administrative credentials on the hub cluster.
My analysis started by examining the provided reference URLs, particularly the Bugzilla entry, which described the vulnerability and pointed to the stolostron/managedcluster-import-controller repository. Since direct commit links were not available, I performed a targeted search for pull requests within that repository using the CVE ID. This led to the discovery of multiple pull requests with the title 'CVE-2026-66795: validate CSR Subject and signerName before auto-approval'.
I then retrieved the commit information for one of these pull requests (#1178, commit 6a398c5a51a7a693695f78b0b8847a8fdfdaf623). The patch clearly shows modifications to pkg/controller/csr/csr_controller.go and the addition of new files pkg/helpers/csr.go and pkg/helpers/csr_test.go.
The critical change in pkg/controller/csr/csr_controller.go is the introduction of a call to helpers.ValidateClusterCSRRequest(csr, clusterName) within the ReconcileCSR.Reconcile method. Before this patch, the Reconcile method would proceed with CSR processing without performing these crucial validations. The helpers.ValidateClusterCSRRequest function, added in pkg/helpers/csr.go, is responsible for decoding the PEM-encoded CSR, inspecting its signerName, and validating the x509 certificate subject (Common Name and Organization) against expected patterns. The absence of this validation logic directly within the ReconcileCSR.Reconcile function's execution path is the root cause of the vulnerability.
Therefore, the ReconcileCSR.Reconcile function is identified as the vulnerable function. When the vulnerability was exploited, a malicious CSR would be processed by this function, which, lacking the necessary validation, would then proceed to auto-approve it, leading to privilege escalation. A runtime profiler would show ReconcileCSR.Reconcile as the function actively processing the CSR during exploitation.
ReconcileCSR.Reconcilepkg/controller/csr/csr_controller.go