Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update

Red Hat Advanced Cluster Management for Kubernetes v2.16 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update

Red Hat Advanced Cluster Management for Kubernetes v2.14 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

CVE-2026-73137 Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-66787

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

CVE-2026-66787

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-controlled IP addresses, causing other clusters'...

CVE-2026-66787 Lighthouse: go pprof profiling endpoint enabled unconditionally on lighthouse-agent :8082

A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by creating EndpointSlices with...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update

Red Hat Advanced Cluster Management for Kubernetes v2.16 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

CVE-2026-18874

A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML Yet Another Markup Language code into the OpenShift Lifecycle Manager OLM Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML...

CVE-2026-66783

A flaw in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes allows a user with permission to modify the Submariner Custom Resource to specify an unvalidated image path . The release workflow consumes a same-org composite action via a mutable @devel branch ref...

EUVD-2026-61067

A flaw was found in the submariner-operator component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability allows a cluster administrator, or any user with permissions to modify the Submariner Custom Resource CR, to specify an unvalidated image path. This lack of validation...

CVE-2026-75485

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

EUVD-2026-60959

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-75485

In Red Hat Advanced Cluster Management for Kubernetes, the must-gather component dumps the cluster Proxy object raw, bypassing oc inspect redaction and exposing proxy basic-auth credentials in the archive. CVSS 5.5 (MEDIUM), local exploit, no in-the-wild exploitation reported. Monitor Red Hat adv...

CVE-2026-75485 Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...

CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834 Must-gather: must-gather: embedded secret data in acm wrapper crs collected without redaction

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834

A flaw in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes allows ACM wrapper Custom Resources that embed Secret data to be collected without redaction . When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archiv...

EUVD-2026-60958

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...

CVE-2026-73834

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...