EUVD-2026-57061
GHSA-crwr-8cwh-w292
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network vector confirmed by Kubernetes API access model; PR:L reflects required specific RHACM channel permissions; S:C captures cross-namespace boundary crossing; C:L/I:L reflect per-Secret scope of unauthorized access.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system.
AnalysisAI
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) enables an authenticated low-privileged user holding specific channel-related permissions to read or modify Kubernetes Secrets outside their authorized namespace scope. The CVSS S:C (Changed Scope) metric confirms the flaw crosses namespace trust boundaries - a critical boundary in multi-tenant Kubernetes environments - potentially exposing credentials, service account tokens, or application secrets belonging to other tenants, and enabling privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated cluster user who holds specific RHACM channel or subscription management permissions - the exact required RBAC roles are not enumerated in available data, but the description explicitly states 'specific permissions' are necessary, ruling out arbitrary low-privileged cluster users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) presents a nuanced profile: low attack complexity and no required user interaction make automation straightforward, but PR:L confirms authentication is required - unauthenticated exploitation is not indicated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated RHACM user with standard channel or subscription management permissions sends a crafted API request to the multicloud-operators-channel operator, supplying a user-controlled namespace reference pointing to a Secret in a namespace they do not own - for example, a namespace belonging to another development team or a cluster-infrastructure namespace containing cluster-admin credentials. The operator processes the request without enforcing RBAC namespace boundaries on the supplied key, returning or modifying the target Secret. … |
| Remediation | No specific fixed version number is confirmed in the available data; apply any Red Hat-released patch for this CVE as soon as it becomes available via the official advisory at https://access.redhat.com/security/cve/CVE-2026-64927 and monitor https://bugzilla.redhat.com/show_bug.cgi?id=2514229 for resolution status and patch release details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today