EUVD-2026-57059
GHSA-37c6-v768-8x6w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network vector via Kubernetes API; PR:L reflects required namespace-admin role; S:C captures cross-namespace Secret access outside the attacker's authorization boundary; no integrity or availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
AnalysisAI
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2 allows an authenticated namespace administrator to read Kubernetes Secrets from arbitrary namespaces outside their own authorization domain. By setting Channel.Spec.SecretRef.Namespace to a target namespace, the attacker causes the subscription controller to autonomously copy sensitive Secret contents into a namespace the attacker controls, violating the Kubernetes namespace isolation model. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated user who holds at minimum namespace-level privileges sufficient to create Channel and Subscription custom resources within their namespace, as confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.7 score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N accurately reflects the threat: the attack traverses the network via the Kubernetes API server, requires only low-complexity manipulation of a single resource field, and achieves a scope change that crosses namespace isolation boundaries to deliver high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A namespace administrator on a shared RHACM cluster creates a Channel resource in their own namespace and sets Channel.Spec.SecretRef.Namespace to a high-value target namespace - such as a namespace holding cloud infrastructure credentials or a production database Secret. The subscription controller, operating with cluster-scoped permissions, interprets that field as authoritative and copies the referenced Secret into the attacker's namespace, where the attacker reads it using standard kubectl commands. … |
| Remediation | The primary remediation is to apply the vendor-released patch once confirmed available per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-66878; no specific fixed version number was present in the available input data, so operators must monitor that advisory and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2514226 for patch release details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Red Hat Advanced Cluster Management for Kubernetes 2 deployments in your environment and confirm whether they operate in multi-tenant mode with multiple administrative users across namespaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today