EUVD-2026-63589
GHSA-gf3r-gm67-jgrv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated tenant (PR:L) reaches the K8s API over the network (AV:N/AC:L) and crosses the tenant boundary (S:C) to gain cluster-wide control with full C/I/A loss.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated ServiceAccount privileges without proper validation. This enables the tenant to deploy arbitrary resources across the entire cluster, leading to a significant security compromise.
AnalysisAI
Privilege escalation and cluster-wide arbitrary resource deployment affects the multicloud-operators-subscription component of Red Hat Advanced Cluster Management for Kubernetes 2. A low-privileged tenant permitted to create HelmRelease custom resources can abuse the HelmRelease controller, which renders and applies Helm chart templates using its own elevated ServiceAccount, to deploy arbitrary resources anywhere in the cluster and bypass namespace/RBAC boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated tenant identity (CVSS PR:L) that has been granted RBAC permission to create HelmRelease custom resources handled by the multicloud-operators-subscription HelmRelease controller in RHACM 2.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine high priority rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A tenant with delegated permission to create HelmRelease CRs in their own namespace submits a crafted Helm chart whose templates declare cluster-scoped objects such as a ClusterRoleBinding granting cluster-admin to the tenant, plus resources in namespaces they do not own. The HelmRelease controller renders and applies these manifests under its own elevated ServiceAccount, so the objects are created cluster-wide, giving the tenant control over the entire cluster. … |
| Remediation | Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-67567 (tracking bug https://bugzilla.redhat.com/show_bug.cgi?id=2514224) and upgrade RHACM to the fixed release once published; no vendor-released patch version is identified in the provided data, so verify the exact patched build directly with Red Hat before scheduling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit and document all systems running RHACM 2 and identify which tenants have HelmRelease creation permissions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) a
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today