EUVD-2026-62669
GHSA-9w6h-ch94-8j27
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H
PR:H confirmed by need to write cluster resource annotations; AC:H reflects non-default OLM configuration prerequisite; I:H and A:H reflect OLM Subscription tampering impact on operator lifecycle.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in volsync-addon-controller. This vulnerability allows an attacker to inject malicious YAML (Yet Another Markup Language) code into the OpenShift Lifecycle Manager (OLM) Subscription resource. This is due to improper escaping of annotation values when they are rendered into YAML. Successful exploitation could lead to unauthorized modification or control over OLM Subscription configurations, potentially impacting software management within the cluster. This issue primarily affects systems where the 'volsync-addon-deploy-type: olm' annotation is explicitly enabled.
AnalysisAI
YAML injection in volsync-addon-controller enables a highly privileged, network-capable attacker to break out of YAML value context when annotation values are rendered into OLM Subscription resources, allowing unauthorized modification of OpenShift operator lifecycle configuration. The root cause (CWE-94) is unsanitized interpolation of Kubernetes annotation strings into generated YAML, and the impact includes high integrity and availability consequences for cluster software management. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three explicit conditions must all be met: (1) the cluster must have VolSync deployed in OLM mode, indicated by the 'volsync-addon-deploy-type: olm' annotation being explicitly set - this is a non-default configuration absent from standard VolSync deployments; (2) the attacker must possess high-privilege cluster credentials sufficient to write or influence annotation values on the relevant Kubernetes resources (PR:H per CVSS); (3) the attack complexity is rated High (AC:H), reflecting the specific injection payload crafting and timing conditions required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.2 score reflects the genuine constraints this vulnerability carries: the network attack vector (AV:N) is offset by high attack complexity (AC:H) and high privilege requirements (PR:H), meaning an attacker must already hold significant cluster access before this flaw becomes exploitable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch released by Red Hat for volsync-addon-controller; the exact fixed version must be obtained from the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-18874, as no specific fix version was enumerated in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today