CVE-2026-70398

CVE-2026-70398 — Normal mode Affected product/area: Red Hat Advanced Cluster Management (RHACM) with the multicloud-integrations component. The issue lies in the GitOpsCluster controller, where an authenticated tenant can manipulate the argoserver/argosamespace logic to write or redirect spoke cl...

EUVD-2026-57058

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

CVE-2026-72526

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-72526 Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the ocm-managed-cluster annotation from an Application Custom Resource CR without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to...

CVE-2026-70398

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer...

PT-2026-70970

Name of the Vulnerable Software and Affected Versions multicloud-integrations affected versions not specified Description A flaw exists in the multicloud-integrations component where the Application propagation controller fails to properly validate the ocm-managed-cluster annotation within an...

PT-2026-70969

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management affected versions not specified Description A flaw in the multicloud-integrations component allows an authenticated tenant to manipulate the GitOpsCluster controller. An attacker can redirect sensitive spoke...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.21.1 security update

Important: Red Hat OpenShift GitOps v1.21.1 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-10083 RC 1.21.0-7: Missing permission for web-based terminal in Argocd UI GITOPS-10178 OpenShift GitOps operator v1.21.0 breaks Redis-HA...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-fips, chisel-fips, external-dns, kube-state-metrics, etcd, knative-kafka-broker-fips, argo-cd, trivy, kots, cilium, kubernetes-dashboard, spire-server, nemo, mattermost, tekton-pipelines-fips, flux-source-controller-fips, harbor-fips, osv-scanner, telegraf,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, chisel-fips, splunk-otel-collector-fips, external-dns, guac, gatus, kube-state-metrics, nuclei, etcd, knative-kafka-broker-fips, argo-cd, trivy, syft-fips, kots, mapotf, cilium, kubernetes-dashboard, spire-server, gh, nemo, buildkitd,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, caddy-fips, step, chisel-fips, crossplane-fips, splunk-otel-collector-fips, external-dns, kyverno-notation-aws-fips, guac, gatus, kube-state-metrics, nuclei, atlantis, etcd, crossplane-provider-azure-netapp, tflint-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-fips, chisel-fips, external-dns, kube-state-metrics, etcd, knative-kafka-broker-fips, argo-cd, trivy, kots, cilium, kubernetes-dashboard, spire-server, nemo, mattermost, tekton-pipelines-fips, flux-source-controller-fips, harbor-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, caddy-fips, step, chisel-fips, crossplane-fips, splunk-otel-collector-fips, external-dns, age-fips, kyverno-notation-aws-fips, guac, gatus, kube-state-metrics, nuclei, atlantis, etcd, crossplane-provider-azure-netapp, tflint-fips,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, splunk-otel-collector-fips, external-dns, guac, kube-state-metrics, nuclei, etcd, knative-kafka-broker-fips, argo-cd, trivy, syft-fips, kots, mapotf, cilium, kubernetes-dashboard, spire-server, nemo, scorecard, mattermost, chainctl-fips,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: trivy-fips, argo-events-fips, chisel-fips, splunk-otel-collector-fips, external-dns, guac, gatus, kube-state-metrics, nuclei, etcd, knative-kafka-broker-fips, argo-cd, trivy, syft-fips, kots, mapotf, cilium, kubernetes-dashboard, spire-server, gh, nemo, buildkitd,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: aactl, crossplane-provider-aws-iam, crossplane-provider-aws-lambda, pulumi, falcoctl, k3s, act, crossplane-provider-aws-ec2, eksctl, gh, kine, prometheus, crossplane-provider-aws-sns, opentofu, crossplane-provider-aws-dynamodb, cilium, crossplane-provider-azure-sql,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: aactl, docker-machine-driver-harvester, pulumi, falcoctl, k3s, act, eksctl, gh, kine, prometheus, opentofu, cilium, crossplane-provider-azure-sql, zarf, openbao, crossplane-provider-azure-storage, slsa-verifier, terragrunt, datadog-agent, helm, buildkitd,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: aactl, external-secrets-operator, flux, k9s, fscrypt, mattermost, nerdctl, trivy-operator, cloud-provider-aws, gitlab-kas, k3s, kyverno, kine, prometheus, kubernetes, rancher, spire-server, cilium, rancher-agent, external-dns, cert-manager, cilium-cli, zarf, snyk-cli...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: aactl, external-secrets-operator, gomplate, flux, pulumi, k9s, fscrypt, mattermost, nerdctl, podman, pulumi-language-java, trivy-operator, cloud-provider-aws, gitlab-kas, act, k3s, kyverno, kine, prometheus, kubernetes, opentofu, syft, spire-server, cilium,...