CVE-2026-7163 — The Assisted-Service REST API, An Optional Assisted Installe Vulnerability

title: CVE-2026-7163 - Assisted-Service API Credentials Download Attempt
id: scw-2026-04-30-ai-1
status: experimental
level: critical
description: |
  Detects attempts to access the /v2/clusters/{cluster_id}/credentials endpoint via the assisted-service REST API. This specific endpoint is used to download administrative credentials (kubeadmin password) for provisioned clusters. The presence of a 'jwt=' query parameter is indicative of an attempt to exploit CVE-2026-7163, as the local authenticator grants access based on a valid JWT embedded in the query string.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7163/
tags:
  - attack.initial_access
  - attack.t1219
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'GET'
      cs-uri:
          - '/v2/clusters/*/credentials'
  selection_base:
      cs-uri-query|contains:
          - 'jwt='
  condition: selection AND selection_base
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse