EUVD-2026-63087
GHSA-37hx-9chj-hc3m
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
AV:N for remote script fetch; AC:H for server compromise or MITM prerequisite; PR:H for attacker needing control of remote script source; S:C as poisoned bundle propagates to downstream Kubernetes clusters.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle.
AnalysisAI
The acm-operator-bundle build pipeline within Red Hat Advanced Cluster Management for Kubernetes 2 fetches and executes a remote script without any cryptographic integrity or authenticity verification (CWE-829), exposing privileged build credentials - including GitHub access tokens and container registry passwords - to attacker-controlled code. An adversary able to compromise the remote script host or intercept the fetch in transit can inject arbitrary code that runs inside the privileged build environment and poisons the resulting operator bundle, extending the blast radius to downstream Kubernetes clusters that consume it (CVSS S:C). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker can control what is served at the specific remote URL the acm-operator-bundle build pipeline fetches - achieved either by compromising the upstream script hosting server, executing DNS cache poisoning against the build host's resolver, or achieving a MITM position on the network path between the build agent and the remote server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) captures several important nuances: AC:H reflects that exploitation is non-trivial - the attacker must either compromise the upstream script server or achieve a MITM position on the build network path; PR:H indicates that meaningful exploitation requires the attacker to hold control over the remote script source, limiting opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised the server hosting the remote build script, or who can intercept the fetch via DNS poisoning or a MITM on the build network segment, substitutes the legitimate script with a malicious version that reads and exfiltrates environment variables containing GitHub tokens and registry credentials to an attacker-controlled endpoint. The attacker then uses those credentials to push backdoored container images to the registry or access source repositories, and the resulting operator bundle - now containing malicious content - is distributed to downstream Kubernetes clusters that apply it through normal ACM reconciliation. … |
| Remediation | The primary fix is to apply the patched acm-operator-bundle version from Red Hat for ACM 2.x; consult the advisory at https://access.redhat.com/security/cve/CVE-2026-76139 for the exact fixed release, as a specific patch version is not confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Red Hat Advanced Cluster Management for Kubernetes 2 installations, identify which are actively building, and audit build pipeline logs for unauthorized script access or credential usage anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (multicloud-integrations / A
Cross-tenant bearer-token disclosure in Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM) lets an authenticat
Unauthorized cross-tenant Secret and ConfigMap access in the multicloud-operators-channel component of Red Hat Advanced
Secret exfiltration across Kubernetes namespace boundaries in the multicloud-operators-subscription component of Red Hat
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 lets a namespace-scoped tenant abuse the mu
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 stems from the search-v2-operator being bou
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) a
Cross-cluster remote code execution in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9 search
Cross-namespace Secret manipulation in the multicloud-operators-channel component of Red Hat Advanced Cluster Management
Command and SQL injection in Red Hat Advanced Cluster Management for Kubernetes 2 (acm-search-v2-rhel9) lets a privilege
Privilege escalation in Red Hat Advanced Cluster Management for Kubernetes 2 allows any attacker with local pod executio
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today