EUVD-2026-60951
GHSA-xh6j-xcjj-j38g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
S:C assigned independently because exploitation on the hub yields cluster-admin on separate managed clusters, crossing Kubernetes security domain boundaries.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.
Articles & Coverage 1
AnalysisAI
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user account on the RHACM hub cluster with Kubernetes RBAC permission to annotate (patch or update) the namespaced ManagedClusterAddOn resource - confirmed by the CVSS PR:L (low privilege) designation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the low-complexity, low-privilege network exploitation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege account on the RHACM hub cluster - for example, a developer with namespace-scoped edit rights - annotates the ManagedClusterAddOn resource for the governance-policy add-on to point to a malicious container image hosted on an attacker-controlled registry. The governance-policy-addon-controller reconciles the change and deploys the attacker's image onto all managed clusters with cluster-admin privileges, granting the attacker full root-equivalent control over those clusters. … |
| Remediation | No exact patched version number is specified in the provided data - patch availability and exact fix versions must be confirmed via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66793 and monitored via Red Hat's errata system. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Advanced Cluster Management deployments and audit which authenticated users currently possess permissions to annotate ManagedClusterAddOn resources; immediately restrict these permissions to administrative accounts only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-20 – Improper Input Validation
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today