What is the CVSS score of CVE-2026-66878?

CVE-2026-66878 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 21.0%.

Which versions of Red Hat ACM are affected by CVE-2026-66878?

Red Hat Advanced Cluster Management for Kubernetes 2 contains a namespace isolation vulnerability allowing authenticated administrators to exfiltrate Kubernetes Secrets across organizational…

How to fix or mitigate CVE-2026-66878?

Within 24 hours, identify all Red Hat Advanced Cluster Management for Kubernetes 2 deployments in your environment and confirm whether they operate in multi-tenant mode with multiple administrative users across namespaces. Within 7 days, implement compensating controls: restrict namespace administrator RBAC roles through granular role bindings limiting cross-namespace resource access, enable comprehensive audit logging for Secret and Channel resource modifications, and deploy monitoring to alert on suspicious Channel.Spec.SecretRef.Namespace specifications. Within 30 days, contact Red Hat support to determine patching availability and timeline, evaluate whether administrative responsibilities can be segregated to separate RHACM cluster instances, or assess viability of external secret management solutions that operate outside the Kubernetes Secret API.

Red Hat ACM CVE-2026-66878

EUVD-2026-57059 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-12 redhat

GHSA-37c6-v768-8x6w

Authentication Bypass Information Disclosure Red Hat Advanced Cluster Management For Kubernetes 2 Red Hat

7.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network vector via Kubernetes API; PR:L reflects required namespace-admin role; S:C captures cross-namespace Secret access outside the attacker's authorization boundary; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

7.7 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 02:01 vuln.today

CVE Published

Aug 12, 2026 - 01:10 cve.org

HIGH 7.7

DescriptionCVE.org

A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.

AnalysisAI

Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. No public exploit code has been identified at time of analysis, but the scope-changed CVSS vector (S:C, C:H) and the sensitivity of Kubernetes Secret payloads - which frequently contain credentials, API tokens, and TLS private keys - make this a high-priority finding in any multi-tenant RHACM deployment.

Technical ContextAI

The multicloud-operators-subscription operator is a core component of Red Hat Advanced Cluster Management for Kubernetes (RHACM) 2.x (CPE: cpe:2.3:a:red_hat:red_hat_advanced_cluster_management_for_kubernetes_2:*:*:*:*:*:*:*:*), responsible for managing GitOps-style Channel and Subscription custom resources across multi-cluster Kubernetes environments. The vulnerability maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where the attacker supplies a user-controlled namespace value in Channel.Spec.SecretRef.Namespace that the subscription controller treats as an authoritative pointer when locating Secrets to copy. Because the controller operates with elevated cluster-level RBAC permissions that span namespace boundaries, a namespace-scoped user can indirectly leverage those permissions to access Secrets they were never explicitly granted. Kubernetes Secrets routinely carry cloud provider credentials, registry pull secrets, database passwords, and TLS certificates, making their unauthorized disclosure a cascading confidentiality risk across dependent workloads.

RemediationAI

The primary remediation is to apply the vendor-released patch once confirmed available per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66878; no specific fixed version number was present in the available input data, so operators must monitor that advisory and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2514226 for patch release details. As an immediate compensating control, audit and minimize the set of users and service accounts that hold permissions to create Channel and Subscription custom resources within RHACM, since these are the exact capabilities required for exploitation - restricting this role reduces the attacker population without requiring downtime. Deploying a Kubernetes admission webhook or OPA/Gatekeeper policy that rejects Channel resources where Spec.SecretRef.Namespace differs from the Channel's own namespace directly blocks the exploitable field manipulation with low operational overhead, though the trade-off is that any legitimate cross-namespace SecretRef usage in existing workflows must be audited and re-authorized before enforcement. Additionally, enabling Kubernetes audit logging for Secret read and create events across namespaces can provide detection coverage while a patch is pending.