acm Schwachstellen (CVE)

7.7Hoch

CVE-2026-89060 vor 1 Monat

Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

multicluster-observability-addon; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted n…

9.1Kritisch

CVE-2026-66786 vor 2 Monaten

Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes …

1.4%EPSS

7.7Hoch

CVE-2026-73137 vor 2 Monaten

Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `G…

9.9Kritisch

CVE-2026-67567 vor 2 Monaten

Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm…

9.9Kritisch

CVE-2026-66788 vor 2 Monaten

Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows…

8.7Hoch

CVE-2026-66787 vor 2 Monaten

Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by …

8.7Hoch

CVE-2026-66785 vor 2 Monaten

Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the netwo…

6.8Mittel

CVE-2026-76827 vor 2 Monaten

Search-indexer: search-indexer: update/delete operations not scoped to caller's cluster (cross-tenant data tampering)

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly …

8.0Hoch

CVE-2026-76139 vor 2 Monaten

Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and…

9.9Kritisch

CVE-2026-70496 vor 2 Monaten

Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (C…

6.2Mittel

CVE-2026-18874 vor 2 Monaten

Volsync-addon-controller: volsync-addon-controller: annotation values rendered into yaml via text/template without escaping allows yaml injection into subscription

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation va…

9.1Kritisch

CVE-2026-71470 vor 2 Monaten

Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By explo…

6.5Mittel

CVE-2026-66780 vor 2 Monaten

Submariner-operator: broker serviceaccount secret (token + ca) logged in full at trace verbosity

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwrit…

4.4Mittel

CVE-2026-66783 vor 2 Monaten

Submariner-operator: release workflow consumes same-org composite action via mutable @devel branch ref

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in the `submariner-operator` component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource (CR), to specify an unvalid…

5.8Mittel

CVE-2026-66782 vor 2 Monaten

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database o…

5.4Mittel

CVE-2026-66781 vor 2 Monaten

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kuberne…

5.5Mittel

CVE-2026-75485 vor 2 Monaten

Must-gather: /tmp/kubeconfig retention

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-aut…

5.5Mittel

CVE-2026-73834 vor 2 Monaten

Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens ar…

8.8Hoch

CVE-2026-66793 vor 2 Monaten

Governance-policy-addon-controller: governance-policy-addon-controller: arbitrary container image override via managedclusteraddon annotation enables rce on spoke

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. Thi…

9.1Kritisch

CVE-2026-71472 vor 2 Monaten

Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string pr…

8.8Hoch

CVE-2026-70495 vor 2 Monaten

Search-v2-operator: search-v2-operator: cluster-wide impersonate on users/groups shared across 4 pods grants hub system:masters

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service acc…

9.9Kritisch

CVE-2026-66792 vor 2 Monaten

Multicloud-operators-subscription: multicloud-operators-subscription: isclusteradmin() trusts user-settable annotations on managed clusters

Red Hat Multicluster Global Hub 1.4.9; Red Hat Multicluster Global Hub 1.5.8; Red Hat Multicluster Global Hub 1.6.6; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker …

6.5Mittel

CVE-2026-71846 vor 2 Monaten

Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secrets get, list, and watch permissions, while the code only requires access to a single specific Secret. This excessive privilege means that …

7.5Hoch

CVE-2026-71469 vor 2 Monaten

Acm-search-v2-api-rhel9: search-v2-api: unbounded tokenreviews cache allows unauthenticated memory-exhaustion dos

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead…

9.0Kritisch

CVE-2026-71471 vor 2 Monaten

Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagated to every spoke as arbitrary container image

Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the at…

1.2%EPSS