CVE-2026-72508

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-72508

The CVE-2026-72508 issue affects the multicloud-operators-subscription component in Red Hat Advanced Cluster Management (RHACM). A namespace-admin tenant can perform a confused‑deputy attack by creating Subscription Custom Resources that leverage a highly privileged ServiceAccount, enabling deplo...

CVE-2026-72508 Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke serviceaccounts bound to wildcard rbac (*/*/*)

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

EUVD-2026-57529

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-72508

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources CRs that leverage a highly privileged ServiceAccount S...

CVE-2026-66878

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to cop...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

EUVD-2026-57061

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-64927 Multicloud-operators-channel: multicloud-operators-channel: cross-namespace secret and configmap mutation via spec.secretref.namespace confused deputy

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-64927

Affects the multicloud-operators-channel component. The vulnerability enables cross-namespace mutation of Secrets (and ConfigMaps) via spec.secretref.namespace, due to a confused deputy flaw, allowing a user with certain permissions to modify Secrets in unauthorized areas and potentially escalate...

CVE-2026-64927

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system namespaces. By exploiting this, an attacker can modify thes...

CVE-2026-73122

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

CVE-2026-73122

The CVE-2026-73122 vulnerability affects the multicloud-operators-channel component in Red Hat Advanced Cluster Management (RHACM). A compromised agent from a managed cluster can read Secrets and ConfigMaps in any Channel namespace on the hub, exposing credentials for other tenants’ Git and Helm ...

CVE-2026-73122 Multicloud-operators-channel: multicloud-operators-channel: auto-generated role grants every managed-cluster agent secrets:get,list,watch in channel namespaces

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

CVE-2026-73122

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management RHACM. This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps withi...

EUVD-2026-57059

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to cop...

CVE-2026-66878 Multicloud-operators-subscription: multicloud-operators-subscription: fetchchannelreferences honours channel.spec.secretref.namespace enabling cross-namespace secret exfiltration

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to cop...

CVE-2026-66878

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to cop...

CVE-2026-66878

CVE-2026-66878 affects multicloud-operators-subscription. A privileged namespace administrator who can create Channel/Subscription resources can abuse Channel.Spec.SecretRef.Namespace to copy secret data from other namespaces into their own, causing information disclosure. The root cause is cross...