CVE-2026-18874

In volsync-addon-controller, annotation values are rendered into YAML via Go's text/template without escaping, enabling YAML injection into the OLM Subscription resource. Exploitation requires high privileges and affects only clusters with the volsync-addon-deploy-type: olm annotation enabled. Re...